finished webmail page

This commit is contained in:
Christoph Haas 2025-08-30 16:54:57 +02:00
parent 9cb7617578
commit 26ac22e4eb

View file

@ -56,11 +56,11 @@ site using the `a2enconf` (apache2 enable config) command or disable it using `a
</details>
Since you ran `certbot` already to create a TLS certificate for your site, the default configuration files for HTTP and
Since you ran `certbot` earlier to create a TLS certificate for your site, the default configuration files for HTTP and
HTTPS have been adapted already:
- **000-default.conf**: This is the virtual host configuration for HTTPS requests. It uses a `RewriteRule` to redirect
users to the HTTPS site.
- **000-default.conf**: This is the virtual host configuration for HTTP requests. It uses a `RewriteRule` to redirect
users to the HTTPS site. So if user accidentally forget to type `https://`, we will add it for them.
- **000-default-le-ssl.conf**: This is the HTTPS virtual host.
So to get Apache to serve the Roundcube application you need to edit the
@ -99,117 +99,73 @@ Fortunately nowadays the basic settings are already as we need them. However the
you:
```
$config['imap_host'] = "tls://webmail.example.org:143";
$config['smtp_host'] = 'tls://webmail.example.org:587';
$config['imap_host'] = "tls://mail.example.org:143";
$config['smtp_host'] = 'tls://mail.example.org:587';
```
So now when your users enter `https://webmail.example.org/` in their browser they should get the Roundcube login form:
Keep in mind that we are using the email address as the account name of the user. So when logging in please enter the
email address as the user name. E.g. john@example.org and password summersun.
<Aside type="tip" title="Login failed? Storage server cant be reached?">
In that case please double check your Dovecot 10-ssl.conf file if you set the path to your Lets Encrypt certificate
correctly. Also check the /var/lib/roundcube/logs/errors.log file for errors.
</Aside>
email address as the user name. E.g. `john@example.org` and password `summersun`.
## Plugins
Roundcube comes with various plugins that you can offer your users. I recommend at least these two:
- password: Let the user change their access password.
- managesieve: Let the user manage rules that apply to incoming email. They can move mails to specific folders
automatically for example.
Roundcube comes with various plugins that you can offer your users. I suggest that you enable at least the **password**
plugin so that your users can change their access password.
Again edit the `/etc/roundcube/config.inc.php` file and look for the _plugins_ configuration. To enable the recommended
plugins change it to:
```
$config['plugins'] = array(
'managesieve',
'password',
);
```
### password plugin
Plugins are configured through files located in the `/etc/roundcube/plugins` directory. Let's quickly set up the
password plugin:
Plugins are configured through files located in the `/etc/roundcube/plugins` directory. Lets begin with the password
plugin. Edit the `/etc/roundcube/plugins/password/config.inc.php` file.
```sh
cat > /etc/roundcube/plugins/password/config.inc.php << EOF
<?php
$config['password_driver'] = 'sql';
$config['password_minimum_length'] = 12;
$config['password_force_save'] = true;
$config['password_algorithm'] = 'blowfish-crypt';
$config['password_algorithm_prefix'] = '{CRYPT}';
$config['password_db_dsn'] = 'mysql://mailadmin:FIRST-PASSWORD-HERER@localhost/mailserver';
$config['password_query'] = "UPDATE virtual_users SET password=%P WHERE email=%u";
?>
EOF
Oops, that file looks pretty empty. But it refers us to an example file at
`/usr/share/roundcube/plugins/password/config.inc.php.dist`. There are many different methods to let users change their
passwords. As we store that information in the SQL database, that is the part we need to set up.
<Aside type="tip" title="No more doveadm">
In previous versions of this guide I used the “doveadm pw” command to generate passwords. This is no longer needed.
Roundcube can now generate the passwords in the right format to be understood by Dovecot.
</Aside>
Remove the empty definition line of $config from your `config.inc.php` file. Lets go through the required settings one
by one:
- `$config['password_driver'] = 'sql';`\
Simple. Use SQL as a backend.
- `$config['password_minimum_length'] = 12;`\
Allow no passwords shorter than 12 characters. I consider longer passwords more secure than short passwords with
weird characters. You can even choose a larger minimum.
- `$config['password_force_save'] = true;`\
This will overwrite the password in the database even if it hasnt changed. It helps us improve the strength of the
password hash by re-encoding it with a better algorithm even if the user chooses to keep his old password.
- `$config['password_algorithm'] = 'blowfish-crypt';`\
The cryptographic algorithm to encode the password. This one is considered very secure and supported by Dovecot.
- `$config['password_algorithm_prefix'] = '{CRYPT}';`\
Prepend every password with this string so that Dovecot knows how we encrypted the password.
- `$config['password_db_dsn'] = 'mysql://mailadmin:gefk6lA2brMOeb8eR5WYaMEdKDQfnF@localhost/mailserver';`\
Connection information for the local database. Use your own password for the _mailadmin_ (!) database user here. We
cannot use the restricted _mailserver_ user because we have to write to the database if the user changes his password.
- `$config['password_query'] = "UPDATE virtual_users SET password=%P WHERE email=%u";`\
The SQL query that is run to write the new password hash into the database. %P is a placeholder for the new password
hash. And %u is the logged-in user and conveniently matches the email address.
Make sure that this config file is not world-readable:
```
chown root:www-data /etc/roundcube/plugins/password/config.inc.php
chmod u=rw,g=r,o= /etc/roundcube/plugins/password/config.inc.php
```
Lets briefly cover the meaning of those lines:
- `$config['password_driver'] = 'sql';`\
Use SQL as a backend.
- `$config['password_minimum_length'] = 12;`\
New passwords must be at least 12 characters long.
- `$config['password_force_save'] = true;`\
This will overwrite the password in the database even if it hasnt changed. It helps us improve the strength of the
password hash by re-encoding it with a better algorithm even if the user chooses to keep his old password.
- `$config['password_algorithm'] = 'blowfish-crypt';`\
The cryptographic algorithm to encode the password. This one is considered very secure and supported by Dovecot.
- `$config['password_algorithm_prefix'] = '{CRYPT}';`\
Prepend every password with this string so that Dovecot knows how we encrypted the password.
- `$config['password_db_dsn'] = 'mysql://mailadmin:FIRST-PASSWORD-HERER@localhost/mailserver';`\
Connection information for the local database. Use your own password for the _mailadmin_ (!) database user here. We
cannot use the restricted _mailserver_ user because we have to write the new password to the database.
- `$config['password_query'] = "UPDATE virtual_users SET password=%P WHERE email=%u";`\
The SQL query that is run to write the new password hash into the database. `%P` is a placeholder for the new password
hash. `%u` is the logged-in user and conveniently matches the email address.
For a complete reference please see `/usr/share/roundcube/plugins/password/config.inc.php.dist`.
The last two lines make sure that this config file is only accessible to everyone.
Try it. Log into Roundcube as `john@example.org` with password summersun. Go to the _Settings_. Choose _Password_.
Enter a new password twice. You should get a success message at the bottom right. Now logout and login with the new
password. Does it work? Great.
### sieve plugin
[Sieve](<https://en.wikipedia.org/wiki/Sieve_(mail_filtering_language)>) is a simple programming language to be used for
server-side rules. Dovecot executes these rules every time a new email comes in. There are global rules that are
executed for every email. And of course every user/mailbox can have its own rules. To manage sieve rules Dovecot offers
the _managesieve_ interface that you enabled earlier. So we just need to tell Roundcube how to access it.
The configuration file for Roundcubes _managesieve_ plugin is found at
`/etc/roundcube/plugins/managesieve/config.inc.php`. Edit the file and again remove the empty or comment the `$config`
line. You can again find all possible configuration options in the
`/usr/share/roundcube/plugins/managesieve/config.inc.php.dist` file.
This time just one setting is required to tell Roundcube which server to talk to:
```
$config['managesieve_host'] = 'localhost';
```
Sieve rules are stored in a special syntax on the server. This is an example that moves all incoming emails to the
_test_ folder that have “test” in the subject:
```
require ["fileinto"];
if header :contains "subject" "test"
{
fileinto "INBOX/test";
}
```
You do not need to learn this syntax though. Roundcubes sieve rule editor is way more user-friendly.
Try adding a sieve rule for `john@example.org` in Roundcube. That feature is located in Settings/Filters. You will find
the machine-readable sieve code at `/var/vmail/example.org/john/sieve/roundcube.sieve`.
The rule editor looks like this: