Difference between revisions of "Roundcube"

From wiki
(Webserver configuration)
(PHP7.0)
 
(9 intermediate revisions by the same user not shown)
Line 1: Line 1:
{{WIP}}
+
== Prerequisite ==
 +
This article is part of the [[Emails/Complete|emails]] series. It is assumed that you already covered [[Dovecot]] and [[Exim]].
 +
 
 +
You will also need the following software:
 +
* [[Nginx]] as a webserver
 +
* [[PHP]]
 +
* [[MariaDB]] as a Database server
 +
* [[Let’s Encrypt]] to get an HTTPS certificate
 +
* [[Fail2Ban]]. Optional but recommended for security.
  
 
== Install ==
 
== Install ==
 +
 +
=== Roundcube ===
 
<syntaxhighlight lang="console">
 
<syntaxhighlight lang="console">
# apt install roundcube roundcube-mysql roundcube-plugins roundcube-plugins-extra apache2-
+
$ sudo apt install roundcube roundcube-mysql roundcube-plugins roundcube-plugins-extra apache2-
 
</syntaxhighlight>
 
</syntaxhighlight>
 
{{Warning}} the ''apache2-'' at the end of the list is preventing the automatic installation of Apache. If you have already Apache installed, you need to remove that from the list as it would uninstall it otherwise.
 
{{Warning}} the ''apache2-'' at the end of the list is preventing the automatic installation of Apache. If you have already Apache installed, you need to remove that from the list as it would uninstall it otherwise.
 +
 +
The installer will ask you the following questions:
 
; Configure database for roundcube with dbconfig-common?
 
; Configure database for roundcube with dbconfig-common?
 
: yes
 
: yes
Line 13: Line 25:
 
: Provide your [[MariaDB]] root password
 
: Provide your [[MariaDB]] root password
 
; MySQL application password for roundcube
 
; MySQL application password for roundcube
: Keep blank
+
: Keep blank   [[Category:Email Server]]  [[Category:Linux Server]]
  
[[Category:Email Server]]
+
=== PHP ===
[[Category:Linux Server]]
+
{{PHP/open basedir|folders=/var/lib/roundcube/:/usr/share/roundcube/:/etc/roundcube/:/var/log/roundcube/}}
 
 
== Configuration ==
 
  
 
=== Web Server ===
 
=== Web Server ===
Line 65: Line 75:
 
         include fastcgi.conf;
 
         include fastcgi.conf;
 
         fastcgi_index index.php;
 
         fastcgi_index index.php;
         fastcgi_pass php5;
+
         fastcgi_pass php;
 
     }   
 
     }   
} }}
+
<nowiki>}</nowiki> }}
 +
 
 +
== Configuration ==
 +
 
 +
=== Mail server ===
 +
Edit file <code>/etc/roundcube/config.inc.php</code> and modify line<syntaxhighlight lang="php">
 +
$config['default_host'] = 'localhost';
 +
</syntaxhighlight>
 +
 
 +
=== Carddav ===
 +
This plugin allows to get contacts from an external source that support the Carddav protocol.
 +
 
 +
==== Update notification ====
 +
This plugin is not packaged in Debian. We will download it from the original website. As for any manually installed software, you need to keep up-to-date with new releases.
 +
 
 +
You can follow new releases of the plugin using feed https://github.com/blind-coder/rcmcarddav/releases.atom.
 +
 
 +
==== Install ====
 +
Download latest release from https://github.com/blind-coder/rcmcarddav/releases. At the time of writing, it is 2.0.4.<syntaxhighlight lang="console">
 +
$ cd /var/lib/roundcube/plugins
 +
$ curl -Ls https://github.com/blind-coder/rcmcarddav/releases/download/v2.0.4/carddav-2.0.4.tar.bz2 | sudo tar xj
 +
$ sudo chmod g-w,o= -R carddav
 +
$ sudo chown root:www-data -R carddav
 +
</syntaxhighlight>Now edit <code>/etc/roundcube/config.inc.php</code><syntaxhighlight lang="php">
 +
// Add carddav to the list of plugins
 +
$config['plugins'] = array(
 +
...
 +
'carddav',
 +
...
 +
);
 +
 
 +
// Disable default address book as we have carddav
 +
$config['address_book_type'] = '';
 +
</syntaxhighlight>Finally, in roundcube, you can go to Settings ⇒ Preferences ⇒ CardDAV and add your server.
 +
 
 +
=== Context Menu ===
 +
Use context menu for various actions.
 +
 
 +
Enable plugin in <code>/etc/roundcube/config.inc.php</code><syntaxhighlight lang="php">
 +
// Add contextmenu to the list of plugins
 +
$config['plugins'] = array(
 +
...
 +
'contextmenu',
 +
...
 +
);
 +
</syntaxhighlight>
 +
 
 +
=== Subscriptions option ===
 +
By default, Roundcube only shows folder that you subscribed to. This plugin allows to show all folders.
 +
 
 +
Enable plugin in <code>/etc/roundcube/config.inc.php</code><syntaxhighlight lang="php">
 +
// Add subscriptions_option to the list of plugins
 +
$config['plugins'] = array(
 +
...
 +
'subscriptions_option',
 +
...
 +
);
 +
 
 +
// Do not use IMAP subscriptions. Show all folders
 +
$config['use_subscriptions'] = false;
 +
</syntaxhighlight>
 +
 
 +
=== Zip Download ===
 +
This plugin allows to download all attachments of an email as one zip archive.
 +
 
 +
Enable the plugin in <code>/etc/roundcube/config.inc.php</code><syntaxhighlight lang="php">
 +
// Add zipdownload to the list of plugins
 +
$config['plugins'] = array(
 +
...
 +
'zipdownload',
 +
...
 +
);
 +
</syntaxhighlight>
 +
== Fail2Ban ==
 +
Create file <code>/etc/fail2ban/jail.d/roundcube-auth.conf</code><syntaxhighlight lang="ini">
 +
[roundcube-auth]
 +
enabled = true
 +
logpath = %(roundcube_errors_log)s
 +
</syntaxhighlight>And activate the new jail<syntaxhighlight lang="console">
 +
$ sudo fail2ban-client reload roundcube-auth
 +
ERROR  NOK: ('roundcube-auth',)
 +
</syntaxhighlight>
 +
[[Category:Fail2Ban]]

Latest revision as of 08:49, 24 June 2017

Prerequisite

This article is part of the emails series. It is assumed that you already covered Dovecot and Exim.

You will also need the following software:

Install

Roundcube

$ sudo apt install roundcube roundcube-mysql roundcube-plugins roundcube-plugins-extra apache2-

Warning Warning: the apache2- at the end of the list is preventing the automatic installation of Apache. If you have already Apache installed, you need to remove that from the list as it would uninstall it otherwise.

The installer will ask you the following questions:

Configure database for roundcube with dbconfig-common?
yes
Database type to be used by roundcube
mysql
Password of the database's administrative user
Provide your MariaDB root password
MySQL application password for roundcube
Keep blank

PHP

Edit file /etc/php/7.0/mods-available/local-common.ini and add /var/lib/roundcube/:/usr/share/roundcube/:/etc/roundcube/:/var/log/roundcube/ to the open_basedir setting.

Reload PHP:

$ sudo systemctl reload php7.0-fpm.service

Web Server

  1. Create the config file /etc/nginx/sites-available/mail.example.org
    server {
        include snippets/listen-http.conf;
        server_name mail.example.org;
    
        access_log /var/log/nginx/mail.example.org.access.log;
        error_log /var/log/nginx/mail.example.org.error.log;
    
        include snippets/https-permanent-redirect.conf;
    }
    
    server {
        include snippets/listen-https.conf;
        server_name mail.example.org;
    
        access_log /var/log/nginx/mail.example.org.access.log;
        error_log /var/log/nginx/mail.example.org.error.log;
    
        include snippets/acme-challenge.conf;
        #include snippets/ssl.conf;
        #ssl_certificate      /etc/letsencrypt/live/mail.example.org/fullchain.pem;
        #ssl_certificate_key  /etc/letsencrypt/live/mail.example.org/privkey.pem;
        #include snippets/hsts.conf;
    
        client_max_body_size 10G; # set max upload size
    
        root /var/lib/roundcube/;
    
        
        location ~ ^/(config|temp|logs)/ {
            deny all;
        }   
        
        location ~ /\. {
            deny all;
            access_log off;
            log_not_found off;
        }   
        
        index index.php;
    
        location ~ \.php$ {
            try_files $uri =404;
            include fastcgi.conf;
            fastcgi_index index.php;
            fastcgi_pass php;
        }   
    }
    
  2. Activate the configuration with
    $ sudo nginx_modsite -e mail.example.org
    Would you like to reload the Nginx configuration now? (Y/n) Y
    
  3. Edit file /usr/local/etc/certmanage/main.json and add the following to the list
    {
        "domains": ["mail.example.org"],
        "reload": [["/bin/systemctl", "reload", "nginx.service"]]
    }
    
  4. Get your certificate
    $ sudo /usr/local/sbin/certmanage
    Renewing certificate for mail.example.org that will expire on 0001-01-01
    
    Saving debug log to /var/log/letsencrypt/letsencrypt.log
    Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
    Obtaining a new certificate
    Performing the following challenges:
    http-01 challenge for mail.example.org
    Using the webroot path /var/www/acme-challenge for all unmatched domains.
    Waiting for verification...
    Cleaning up challenges
    Generating key (2048 bits): /etc/letsencrypt/keys/1764_key-certbot.pem
    Creating CSR: /etc/letsencrypt/csr/1764_csr-certbot.pem
    
    IMPORTANT NOTES:
     - Congratulations! Your certificate and chain have been saved at
       /etc/letsencrypt/live/mail.example.org/fullchain.pem. Your cert
       will expire on 2025-03-22. To obtain a new or tweaked version of
       this certificate in the future, simply run certbot again. To
       non-interactively renew *all* of your certificates, run "certbot
       renew"
     - If you like Certbot, please consider supporting our work by:
    
       Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
       Donating to EFF:                    https://eff.org/donate-le
    
    Restarting services:
    systemctl reload nginx.service
    
  5. Uncomment the ssl related lines in /etc/nginx/sites-available/mail.example.org and run
    $ sudo systemctl reload nginx.service
    

Configuration

Mail server

Edit file /etc/roundcube/config.inc.php and modify line

$config['default_host'] = 'localhost';

Carddav

This plugin allows to get contacts from an external source that support the Carddav protocol.

Update notification

This plugin is not packaged in Debian. We will download it from the original website. As for any manually installed software, you need to keep up-to-date with new releases.

You can follow new releases of the plugin using feed https://github.com/blind-coder/rcmcarddav/releases.atom.

Install

Download latest release from https://github.com/blind-coder/rcmcarddav/releases. At the time of writing, it is 2.0.4.

$ cd /var/lib/roundcube/plugins
$ curl -Ls https://github.com/blind-coder/rcmcarddav/releases/download/v2.0.4/carddav-2.0.4.tar.bz2 | sudo tar xj
$ sudo chmod g-w,o= -R carddav
$ sudo chown root:www-data -R carddav

Now edit /etc/roundcube/config.inc.php

// Add carddav to the list of plugins
$config['plugins'] = array(
...
'carddav',
...
);

// Disable default address book as we have carddav
$config['address_book_type'] = '';

Finally, in roundcube, you can go to Settings ⇒ Preferences ⇒ CardDAV and add your server.

Context Menu

Use context menu for various actions.

Enable plugin in /etc/roundcube/config.inc.php

// Add contextmenu to the list of plugins
$config['plugins'] = array(
...
'contextmenu',
...
);

Subscriptions option

By default, Roundcube only shows folder that you subscribed to. This plugin allows to show all folders.

Enable plugin in /etc/roundcube/config.inc.php

// Add subscriptions_option to the list of plugins
$config['plugins'] = array(
...
'subscriptions_option',
...
);

// Do not use IMAP subscriptions. Show all folders
$config['use_subscriptions'] = false;

Zip Download

This plugin allows to download all attachments of an email as one zip archive.

Enable the plugin in /etc/roundcube/config.inc.php

// Add zipdownload to the list of plugins
$config['plugins'] = array(
...
'zipdownload',
...
);

Fail2Ban

Create file /etc/fail2ban/jail.d/roundcube-auth.conf

[roundcube-auth]
enabled = true
logpath = %(roundcube_errors_log)s

And activate the new jail

$ sudo fail2ban-client reload roundcube-auth
ERROR  NOK: ('roundcube-auth',)