diff --git a/src/content/docs/ispmail-trixie/170-webmail.mdx b/src/content/docs/ispmail-trixie/170-webmail.mdx index 06e2608..124c552 100644 --- a/src/content/docs/ispmail-trixie/170-webmail.mdx +++ b/src/content/docs/ispmail-trixie/170-webmail.mdx @@ -56,11 +56,11 @@ site using the `a2enconf` (apache2 enable config) command or disable it using `a -Since you ran `certbot` already to create a TLS certificate for your site, the default configuration files for HTTP and +Since you ran `certbot` earlier to create a TLS certificate for your site, the default configuration files for HTTP and HTTPS have been adapted already: -- **000-default.conf**: This is the virtual host configuration for HTTPS requests. It uses a `RewriteRule` to redirect - users to the HTTPS site. +- **000-default.conf**: This is the virtual host configuration for HTTP requests. It uses a `RewriteRule` to redirect + users to the HTTPS site. So if user accidentally forget to type `https://`, we will add it for them. - **000-default-le-ssl.conf**: This is the HTTPS virtual host. So to get Apache to serve the Roundcube application you need to edit the @@ -99,117 +99,73 @@ Fortunately nowadays the basic settings are already as we need them. However the you: ``` -$config['imap_host'] = "tls://webmail.example.org:143"; -$config['smtp_host'] = 'tls://webmail.example.org:587'; +$config['imap_host'] = "tls://mail.example.org:143"; +$config['smtp_host'] = 'tls://mail.example.org:587'; ``` So now when your users enter `https://webmail.example.org/` in their browser they should get the Roundcube login form: Keep in mind that we are using the email address as the account name of the user. So when logging in please enter the -email address as the user name. E.g. ‘john@example.org’ and password ‘summersun’. - - +email address as the user name. E.g. `john@example.org` and password `summersun`. ## Plugins -Roundcube comes with various plugins that you can offer your users. I recommend at least these two: - -- password: Let the user change their access password. -- managesieve: Let the user manage rules that apply to incoming email. They can move mails to specific folders - automatically for example. +Roundcube comes with various plugins that you can offer your users. I suggest that you enable at least the **password** +plugin so that your users can change their access password. Again edit the `/etc/roundcube/config.inc.php` file and look for the _plugins_ configuration. To enable the recommended plugins change it to: ``` $config['plugins'] = array( - 'managesieve', 'password', ); ``` -### password plugin +Plugins are configured through files located in the `/etc/roundcube/plugins` directory. Let's quickly set up the +password plugin: -Plugins are configured through files located in the `/etc/roundcube/plugins` directory. Let’s begin with the password -plugin. Edit the `/etc/roundcube/plugins/password/config.inc.php` file. +```sh +cat > /etc/roundcube/plugins/password/config.inc.php << EOF + +EOF -Oops, that file looks pretty empty. But it refers us to an example file at -`/usr/share/roundcube/plugins/password/config.inc.php.dist`. There are many different methods to let users change their -passwords. As we store that information in the SQL database, that is the part we need to set up. - - - -Remove the empty definition line of $config from your `config.inc.php` file. Let’s go through the required settings one -by one: - -- `$config['password_driver'] = 'sql';`\ - Simple. Use SQL as a backend. -- `$config['password_minimum_length'] = 12;`\ - Allow no passwords shorter than 12 characters. I consider longer passwords more secure than short passwords with - weird characters. You can even choose a larger minimum. -- `$config['password_force_save'] = true;`\ - This will overwrite the password in the database even if it hasn’t changed. It helps us improve the strength of the - password hash by re-encoding it with a better algorithm even if the user chooses to keep his old password. -- `$config['password_algorithm'] = 'blowfish-crypt';`\ - The cryptographic algorithm to encode the password. This one is considered very secure and supported by Dovecot. -- `$config['password_algorithm_prefix'] = '{CRYPT}';`\ - Prepend every password with this string so that Dovecot knows how we encrypted the password. -- `$config['password_db_dsn'] = 'mysql://mailadmin:gefk6lA2brMOeb8eR5WYaMEdKDQfnF@localhost/mailserver';`\ - Connection information for the local database. Use your own password for the _mailadmin_ (!) database user here. We - cannot use the restricted _mailserver_ user because we have to write to the database if the user changes his password. -- `$config['password_query'] = "UPDATE virtual_users SET password=%P WHERE email=%u";`\ - The SQL query that is run to write the new password hash into the database. %P is a placeholder for the new password - hash. And %u is the logged-in user and conveniently matches the email address. - -Make sure that this config file is not world-readable: - -``` chown root:www-data /etc/roundcube/plugins/password/config.inc.php chmod u=rw,g=r,o= /etc/roundcube/plugins/password/config.inc.php ``` +Let’s briefly cover the meaning of those lines: + +- `$config['password_driver'] = 'sql';`\ + Use SQL as a backend. +- `$config['password_minimum_length'] = 12;`\ + New passwords must be at least 12 characters long. +- `$config['password_force_save'] = true;`\ + This will overwrite the password in the database even if it hasn’t changed. It helps us improve the strength of the + password hash by re-encoding it with a better algorithm even if the user chooses to keep his old password. +- `$config['password_algorithm'] = 'blowfish-crypt';`\ + The cryptographic algorithm to encode the password. This one is considered very secure and supported by Dovecot. +- `$config['password_algorithm_prefix'] = '{CRYPT}';`\ + Prepend every password with this string so that Dovecot knows how we encrypted the password. +- `$config['password_db_dsn'] = 'mysql://mailadmin:FIRST-PASSWORD-HERER@localhost/mailserver';`\ + Connection information for the local database. Use your own password for the _mailadmin_ (!) database user here. We + cannot use the restricted _mailserver_ user because we have to write the new password to the database. +- `$config['password_query'] = "UPDATE virtual_users SET password=%P WHERE email=%u";`\ + The SQL query that is run to write the new password hash into the database. `%P` is a placeholder for the new password + hash. `%u` is the logged-in user and conveniently matches the email address. + +For a complete reference please see `/usr/share/roundcube/plugins/password/config.inc.php.dist`. + +The last two lines make sure that this config file is only accessible to everyone. + Try it. Log into Roundcube as `john@example.org` with password ‘summersun’. Go to the _Settings_. Choose _Password_. Enter a new password twice. You should get a success message at the bottom right. Now logout and login with the new password. Does it work? Great. - -### sieve plugin - -[Sieve]() is a simple programming language to be used for -server-side rules. Dovecot executes these rules every time a new email comes in. There are global rules that are -executed for every email. And of course every user/mailbox can have its own rules. To manage sieve rules Dovecot offers -the _managesieve_ interface that you enabled earlier. So we just need to tell Roundcube how to access it. - -The configuration file for Roundcube’s _managesieve_ plugin is found at -`/etc/roundcube/plugins/managesieve/config.inc.php`. Edit the file and again remove the empty or comment the `$config` -line. You can again find all possible configuration options in the -`/usr/share/roundcube/plugins/managesieve/config.inc.php.dist` file. - -This time just one setting is required to tell Roundcube which server to talk to: - -``` -$config['managesieve_host'] = 'localhost'; -``` - -Sieve rules are stored in a special syntax on the server. This is an example that moves all incoming emails to the -_test_ folder that have “test” in the subject: - -``` -require ["fileinto"]; -if header :contains "subject" "test" -{ - fileinto "INBOX/test"; -} -``` - -You do not need to learn this syntax though. Roundcube’s sieve rule editor is way more user-friendly. - -Try adding a sieve rule for `john@example.org` in Roundcube. That feature is located in Settings/Filters. You will find -the machine-readable sieve code at `/var/vmail/example.org/john/sieve/roundcube.sieve`. - -The rule editor looks like this: