Postfix Mailman Install Vandurkar
Postfix Mailman Install Vandurkar
V.J. Vandurkar,
A. Postfix
Postfix is the default Mail Transfer Agent (MTA) in Ubuntu. It attempts to be fast and easy to
administer and secure. It is compatible with the MTA sendmail. This section explains how to install
and configure postfix. It also explains how to set it up as an SMTP server using a secure connection
(for sending emails securely).
Installation
To install postfix run the following command:
Basic Configuration
To configure postfix, run the following command:
sudo dpkg-reconfigure postfix
The user interface will be displayed. On each screen, select the following
values:
Internet Site
mail.example.com
steve
mail.example.com, localhost.localdomain, localhost
No
127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.0.0/24
0
+
all
Replace mail.example.com with the domain for which you'll accept email,
192.168.0.0/24 with the actual network and class range of your mail server, and
steve with the appropriate username.
Now is a good time to decide which mailbox format you want to use. By default
Postfix will use mbox for the mailbox format. Rather than editing the
configuration file directly, you can use the postconf command to configure all
postfix parameters. The configuration parameters will be stored in /etc/postfix/
main.cf file. Later if you wish to re-configure a particular parameter, you can
either run the command or change it manually in the file.
SMTP Authentication
SMTP-AUTH allows a client to identify itself through an authentication mechanism
(SASL). Transport Layer Security (TLS) should be used to encrypt the
authentication process. Once authenticated the SMTP server will allow the client
to relay mail.
2. Next, generate or obtain a digital certificate for TLS. See Certificates for details. This example
also uses a Certificate Authority (CA). For information on generating a CA certificate see
Certification Authority.
Note:MUAs connecting to your mail server via TLS will need to recognize the
certificate used for TLS. This can either be done using a certificate from a
commercial CA or with a self-signed certificate that users manually
install/accept. For MTA to MTA TLS certficates are never validated without
advance agreement from the affected organizations. For MTA to MTA TLS, unless
local policy requires it, there is no reason not to use a self-signed
certificate. Refer to Creating a Self-Signed Certificate for more details.
The above command will prompt you to enter the passphrase. Once you enter the correct
passphrase, your certificate will be created and it will be stored in the server.crt file.
Note: If your secure server is to be used in a production environment, you
probably need a CA-signed certificate. It is not recommended to use self-signed
certificate.
Now simply configure any applications, with the ability to use public-key cryptography, to use the
certificate and key files. For example, Apache can provide HTTPS, Dovecot can provide IMAPS
and POP3S, etc.
3.Once you have a certificate, configure Postfix to provide TLS encryption for both incoming and
outgoing mail:
sudo postconf -e 'smtp_tls_security_level = may'
sudo postconf -e 'smtpd_tls_security_level = may'
sudo postconf -e 'smtp_tls_note_starttls_offer = yes'
sudo postconf -e 'smtpd_tls_key_file = /etc/ssl/private/server.key'
sudo postconf -e 'smtpd_tls_cert_file = /etc/ssl/certs/server.crt'
sudo postconf -e 'smtpd_tls_loglevel = 1'
sudo postconf -e 'smtpd_tls_received_header = yes'
sudo postconf -e 'myhostname = mail.example.com'
4.If you are using your own Certificate Authority to sign the certificate enter:
Note:After running all the commands, Postfix is configured for SMTP-AUTH and a
self-signed certificate has been created for TLS encryption.
# version
myhostname = server1.example.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = server1.example.com, localhost.example.com, localhost
relayhost =
mynetworks = 127.0.0.0/8
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
smtpd_sasl_local_domain =
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions =
permit_sasl_authenticated,permit_mynetworks,reject _unauth_destination
smtpd_tls_auth_only = no
smtp_tls_security_level = may
smtpd_tls_security_level = may
smtp_tls_note_starttls_offer = yes
smtpd_tls_key_file = /etc/ssl/private/smtpd.key
smtpd_tls_cert_file = /etc/ssl/certs/smtpd.crt
smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
# is /etc/mailname.
#myorigin = /etc/mailname
biff = no
append_dot_mydomain = no
#delay_warning_time = 4h
readme_directory = no
# TLS parameters
smtpd_tls_cert_file = /etc/ssl/certs/server.crt
smtpd_tls_key_file = /etc/ssl/private/server.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
myhostname = epsilon.me.iitb.ac.in
mydomain = me.iitb.ac.in
masquerade_domains = me.iitb.ac.in
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
#myorigin = /etc/mailname
myorigin = $mydomain
relayhost = smtp.iitb.ac.in
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
home_mailbox = Maildir/
smtpd_sasl_type = cyrus
smtpd_sasl_path = private/auth
smtpd_sasl_local_domain =
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_auth_enable = yes
smtp_tls_security_level = may
smtpd_tls_security_level = may
smtp_tls_note_starttls_offer = yes
smtpd_tls_loglevel = 4
smtpd_tls_received_header = yes
#default_transport = smtp:[smtp.iitb.ac.in]
relay_domains = $mydestination
#transport_maps = hash:/etc/postfix/transport
mailman_destination_recipient_limit = 1
local_recipient_maps =
unknown_local_recipient_reject_code = 550
compatibility_level = 2
smtpd_client_restrictions = hash:/etc/postfix/access
smtpd_client_connection_rate_limit = 0
default_destination_concurrency_limit = 20
disable_vrfy_command = yes
fast_flush_domains = me.iitb.ac.in,iitb.ac.in
Configuring SASL
Postfix supports two SASL implementations Cyrus SASL and Dovecot SASL. To enable Dovecot
SASL the dovecot-core package will need to be installed. From a terminal prompt enter the
following:
sudo apt install dovecot-core
Next you will need to edit /etc/dovecot/conf.d/10-master.conf. Change the following:
service auth {
# auth_socket_path points to this userdb socket by default. It's typically
# used by dovecot-lda, doveadm, possibly imap process, etc. Its default
# permissions make it readable only by root, but you may need to relax these
# permissions. Users that have access to this socket are able to get a list
# of all usernames and get results of everyone's userdb lookups.
unix_listener auth-userdb {
#mode = 0600
#user =
#group =
}
# Postfix smtp-auth
unix_listener /var/spool/postfix/private/auth {
mode = 0660
user = postfix
group = postfix
}
In order to let Outlook clients use SMTP-AUTH, in the authentication mechanisms section of
/etc/dovecot/conf.d/10-auth.conf change this line:
auth_mechanisms = plain
To this:
Testing
SMTP-AUTH configuration is complete. Now it is time to test the setup.
To see if SMTP-AUTH and TLS work properly, run the following command:
telnet epsilon.metemp.iitb.ac.in 25
After you have established the connection to the postfix mail server, type:
ehlo epsilon.metemp.iitb.ac.in
If you see the following lines among others, then everything is working perfectly. Type quit to exit.
250-STARTTLS
250-AUTH LOGIN PLAIN
250-AUTH=LOGIN PLAIN
250 8BITMIME
Troubleshooting
This section introduces some common ways to determine the cause if problems arise.
Escaping chroot
The Ubuntu postfix package will by default install into a chroot environment for security reasons.
This can add greater complexity when troubleshooting problems.
To turn off the chroot operation locate for the following line in the /etc/postfix/master.cf
configuration file:
smtp inet n - - - - smtpd
and modify it as follows:
smtp inet n - n - - smtpd
You will then need to restart Postfix to use the new configuration. From a terminal prompt enter:
sudo systemctl restart postfix.service
Smtps
If you need smtps, edit /etc/postfix/master.cf and uncomment the following line:
smtps inet n - - - - smtpd
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
-o milter_macro_daemon_name=ORIGINATING
Log Files
Postfix sends all log messages to /var/log/mail.log. However error and warning messages can
sometimes get lost in the normal log output so they are also logged to /var/log/mail.err and /var/log/
mail.warn respectively.
To see messages entered into the logs in real time you can use the tail -f command:
tail -f /var/log/mail.err
The amount of detail that is recorded in the logs can be increased. Below are some configuration
options for increasing the log level for some of the areas covered above.
To increase TLS activity logging set the smtpd_tls_loglevel option to a value from 1 to 4.
sudo postconf -e 'smtpd_tls_loglevel = 4'
If you are having trouble sending or receiving mail from a specific domain you can add the
domain to the debug_peer_list parameter.
sudo postconf -e 'debug_peer_list = problem.domain'
You can increase the verbosity of any Postfix daemon process by editing the
/etc/postfix/master.cf and adding a -v after the entry. For example edit the smtp entry:
smtp unix - - - - - smtp -v
It is important to note that after making one of the logging changes above the Postfix process will
need to be reloaded in order to recognize the new configuration: sudo systemctl reload
postfix.service
To increase the amount of information logged when troubleshooting SASL issues you can
set the following options in /etc/dovecot/conf.d/10-logging.conf
auth_debug=yes
auth_debug_passwords=yes
Just like Postfix if you change a Dovecot configuration the process will need to be reloaded: sudo
systemctl reload dovecot.service.
Some of the options above can drastically increase the amount of information sent to the log files.
Remember to return the log level back to normal after you have corrected the problem. Then reload
the appropriate daemon for the new configuration to take affect.
B. Mailman
To install Mailman, run following command at a terminal prompt:
It copies the installation files in /var/lib/mailman directory. It installs the CGI scripts in /usr/lib/cgi-
bin/mailman directory. It creates list linux user. It creates the list linux group. The mailman process
will be owned by this user.
Configuration
This section assumes you have successfully installed mailman, apache2, and postfix.In order for
Apache to use the config file it needs to be copied to /etc/apache2/sites-available:
sudo cp /etc/mailman/apache.conf /etc/apache2/sites-available/mailman.conf
<VirtualHost *:80>
# Logos:
# Use this if you don't want the "cgi-bin" component in your URL:
# In case you want to access mailman through a shorter URL you should enable
# this:
# authentication code to work. Note that you need to change the base
<Directory /usr/lib/cgi-bin/mailman/>
AllowOverride None
Options ExecCGI
</Directory>
<Directory /var/lib/mailman/archives/public/>
Options FollowSymlinks
AllowOverride None
</Directory>
<Directory /usr/share/images/mailman/>
AllowOverride None
</Directory>
#DEFAULT_EMAIL_HOST = 'lists.example.net'
#DEFAULT_URL_HOST = 'lists.example.net'
#DEFAULT_URL_PATTERN = 'http://%s/'
ServerName epsilon.me.iitb.ac.in
ServerAlias me.iitb.ac.in
DocumentRoot /var/www/lists
ErrorLog /var/log/apache2/lists-error.log
<Directory /var/lib/mailman/archives/>
Options FollowSymLinks
AllowOverride None
</Directory>
ScriptAlias / /usr/lib/cgi-bin/mailman/listinfo
</VirtualHost>
content of file mailman.conf end.
This will setup a new Apache VirtualHost for the Mailman administration site. Now enable the new
configuration and restart Apache:
sudo a2ensite mailman.conf
Mailman uses apache2 to render its CGI scripts. The mailman CGI scripts are installed in the
/usr/lib/cgi-bin/mailman directory. So, the mailman url will be http://hostname/cgi-bin/mailman/.
You can make changes to the /etc/apache2/sites-available/mailman.conf file if you wish to change
this behavior.
For Postfix integration, we will associate the domain lists.example.com with the mailing lists.
Please replace lists.example.com with the domain of your choosing.
Once mailman is installed, you can run it using the following command:
sudo systemctl start mailman.service
Once mailman is installed, you should create the default mailing list. Run the following command
to create the mailing list:
sudo /usr/sbin/newlist mailman
Enter the email address of the person running the list: bhuvan at ubuntu.com
Initial mailman password:
To finish creating your mailing list, you must edit your /etc/aliases (or
equivalent) file by adding the following lines, and possibly running the
`newaliases' program:
Administration
We assume you have a default installation. The mailman cgi scripts are still in the
/usr/lib/cgi-bin/mailman/ directory. Mailman provides a web based administration facility. To
access this page, point your browser to the following url:
http://hostname/cgi-bin/mailman/admin
The default mailing list, mailman, will appear in this screen. If you click the mailing list name, it
will ask for your authentication password. If you enter the correct password, you will be able to
change administrative settings of this mailing list. You can create a new mailing list using the
command line utility (/usr/sbin/newlist). Alternatively, you can create a new mailing list using the
web interface.
Generating password to create mailling listing with gui (example phdtest)
sudo mmsitepass xyz123
Example for creating list on mailman site
epsilon.me.iitb.ac.in/cgi-bin/mailman/create
Users
Mailman provides a web based interface for users. To access this page, point your browser to the
following url:
http://hostname/cgi-bin/mailman/listinfo
The default mailing list, mailman, will appear in this screen. If you click the mailing list name, it
will display the subscription form. You can enter your email address, name (optional), and
password to subscribe. An email invitation will be sent to you. You can follow the instructions in
the email to subscribe.
https://help.ubuntu.com/lts/serverguide/mailman.html
For configuring mailman and to resolve issue of implicit destination, please use the following url
https://wiki.list.org/DOC/What%20does%20%22message%20has%20implicit%20destination
%22%20mean%3F
Contents
Prerequisites
To follow this tutorial, you will need:
One Ubuntu 16.04 server set up by following this Ubuntu 16.04 initial server setup tutorial,
including a sudo non-root user and a firewall.
The LAMP stack installed by following this LAMP on Ubuntu 16.04 tutorial.
An IMAP-based email server. For simplicity, this article will use Gmail, but any IMAP-
based email server will work. Make sure you know the IMAP and SMTP settings for your
email server.
Update your package index and install all of these dependencies at once.
sudo apt-get update
sudo apt-get install php-xml php-mbstring php-intl php-zip php-pear zip unzip
git composer
Next, some of the PHP libraries need to be enabled in the server’s php.ini file, which is located
at /etc/php/7.0/apache2/php.ini. Open this file with nano or your favorite text editor.
sudo nano /etc/php/7.0/apache2/php.ini
Many of the changes necessary are just enabling options that have been commented out. In
php.ini files, commented lines start with a ; semicolon (instead of the more common # hash
symbol). To uncomment a line, delete this leading semicolon; to comment a line, add a leading
semicolon.
Search for the section that contains many commented lines beginning with extension=.
Uncomment the lines for the php_mbstring.dll and php_xmlrpc.dll extensions.
/etc/php/7.0/apache2/php.ini
. . .
;extension=php_interbase.dll
;extension=php_ldap.dll
extension=php_mbstring.dll
;extension=php_exif.dll ; Must be after mbstring as it depends on it
;extension=php_mysqli.dll
. . .
;extension=php_sqlite3.dll
;extension=php_tidy.dll
extension=php_xmlrpc.dll
;extension=php_xsl.dll
. . .
/etc/php/7.0/apache2/php.ini
. . .
extension=php_xmlrpc.dll
;extension=php_xsl.dll
extension=dom.so
. . .
Next, search for the upload_max_filesize setting. This setting mainly affects uploading
attachments. By default, it’s set to 2MB. You can set it to any amount you want, but most email
servers limit the total attachment size to 10MB. We’ll set it to 12MB here in the event that multiple
users are adding attachments at the same time.
/etc/php/7.0/apache2/php.ini
. . .
; Maximum allowed size for uploaded files.
; http://php.net/upload-max-filesize
upload_max_filesize = 12M
. . .
Next, search for post_max_size. Whereas the upload_max_filesize setting applied only
to attachments, this setting applies to the size of the whole email (including attachments). To
prevent deadlocks, we’ll set this one to a slightly higher value.
/etc/php/7.0/apache2/php.ini
. . .
; Maximum size of POST data that PHP will accept.
; Its value may be 0 to disable the limit. It is ignored if POST data reading
; is disabled through enable_post_data_reading.
; http://php.net/post-max-size
post_max_size = 18M
. . .
Finally, search for mbstring.func_overload, uncomment it, and verify its value is set to 0.
This enables support for multi-byte string functions.
/etc/php/7.0/apache2/php.ini
. . .
mbstring.func_overload = 0
. . .
Arguments for tar can be a bit intimidating, so here’s what each flag does:
The x flag stands for extract.
The v flag stands for verbose, which tells tar to print the path and name of every file
extracted.
The z flag tells tar to not only remove the tar wrapper but to decompress the archive using
gzip. We know the file is compressed with gzip because the file extension has .gz on the
end.
The f flag stands for file. This must be the last flag because tar uses whatever immediately
follows it as the file to be extracted.
Next, move the decompressed directory to /var/www and rename it to roundcube. Make sure to
omit the trailing / in the directory names because we want to move and rename the whole directory,
not the contents in the directory.
sudo mv roundcubemail-1.3.0 /var/www/roundcube
Finally, change the permissions to allow Apache to create and edit the files (like configuration files
and logs). Specifically, change the owner and group to www-data, and change the permissions to
read and write for the owner and group, but read only for everyone else.
sudo chown -R www-data:www-data /var/www/roundcube/
sudo chmod 775 /var/www/roundcube/temp/ /var/www/roundcube/logs/
We’ve downloaded Roundcube’s code and updated its location and permissions, but it’s only
partially installed at this point. To finish the installation, we need to connect Roundcube to our
database via Roundcube’s GUI. Before we can do that, we need to tell Apache where Roundcube is
so it can load the website.
We’ll need to make a number of changes to this file. We’ll walk through each of them first, then
provide the whole file to copy and paste.
In the existing VirtualHost block, you’ll modify the following directives:
The ServerName tells Apache which domain to listen to. This should be your server IP
address or domain name, if you’re using one.
DocumentRoot specifies where to send traffic when it comes in. In our case, we should
send it to Roundcube at /var/www/roundcube.
ServerAdmin lets you specify an contact email address for any issues with Apache. We
aren’t configuring Apache to do that in this tutorial, but it’s best practice to include it
anyway.
The two logging lines, ErrorLog and CustomLog, define where to save successful
connection logs and error logs for this site. We need to give the error logs specific names so
if there is an issue the logs specific to this site are easily found.
Then, you’ll add a new Directory block which tells Apache what to do with the Roundcube
directory. The first word in each line of a Directory block is the configuration name followed by
the actual configuration options.
Options -Indexes tells Apache to display a warning if it can’t find an index.html
or index.php file. By default, it will list the contents of the directory instead.
AllowOverride All tells Apache that if a local .htaccess file is found, any options
in that file override the global settings in this file.
Order allow,deny tells Apache first to allow matching clients access to the site, and
then to deny any that don’t match.
allow from all is a followup to the Order line. It defines what type of client is
allowed, which is any in our case.
Here’s what the file will look like once you’ve made these changes. For brevity, the comments have
been removed.
/etc/apache2/sites-available/roundcube.conf
<VirtualHost *:80>
ServerName your_server_ip_or_domain
DocumentRoot /var/www/roundcube
ServerAdmin [email protected]
ErrorLog ${APACHE_LOG_DIR}/roundcube-error.log
CustomLog ${APACHE_LOG_DIR}/roundcube-access.log combined
<Directory /var/www/roundcube>
Options -Indexes
AllowOverride All
Order allow,deny
allow from all
</Directory>
</VirtualHost>
Then tell Apache to start hosting the Roundcube site instead. Make sure not to include the .conf
when enabling the site; a2ensite wants the file name of the configuration without the extension.
sudo a2ensite roundcube
Enable the mod_rewrite Apache module, which Roundcube requires.
sudo a2enmod rewrite
Finally, restart Apache, which will make the Roundcube installation accessible.
sudo apache2ctl restart
The webmail client is almost ready to use. The last step of the installation process is to configure
the database so Roundcube can store its app-specific data.
After entering the command you’ll be prompted for the root password you created when you
installed MySQL.
Now that we’re in the MySQL shell, we’ll create a database and a database user, and then give that
user permissions to execute commands on that new database.
Create the database first. This command creates a database called roundcubemail and then
provides database options, like the character set to use (utf8).
CREATE DATABASE roundcubemail /*!40101 CHARACTER SET utf8 COLLATE
utf8_general_ci */;
Unlike many other authentication systems, MySQL defines a user by a name and where they’ll
connect from. This command creates a user called roundcube and defines that user to connect from
localhost. For applications accessing a database, defining where the user will make the request
from helps tighten security.
Create this user, making sure to change the password to something secure.
CREATE USER 'roundcube'@'localhost' IDENTIFIED BY 'password';
Give the roundcube user all permissions on the roundcubemail database and all of its tables.
GRANT ALL PRIVILEGES ON roundcubemail.* to 'roundcube'@'localhost';
Then save your changes and quit the MySQL interactive shell.
FLUSH PRIVILEGES;
EXIT;
If everything’s set up properly, there will be a green OK to the right of every line item, except for a
few: the optional LDAP setting and every database line except MySQL. If there is a NOT
AVAILABLE next to any other line than those just mentioned, you’ll need to install those
dependencies. Roundcube helpfully provides a link for any missing dependency so you can figure
out what to install.
Once everything is set up correctly, scroll down to the bottom of the page and click the NEXT
button.
The form on the next page, which is broken into seven sections, walks through generating the
Roundcube configuration file. Below are the portions of the form we need to fill out, divided by
section. If a line from the form is excluded in the sections below, you can skip that line and leave it
with the default settings.
General configuration
The General configuration section provides a few cosmetic options for customization and some
general settings. There’s only one option you should change here:
Make sure ip_check is ticked for greater security. It checks the client’s IP in session
authorization.
There are a few more optional changes you can make, too:
You can change the product_name. This can be anything you wish and all references to
“Roundcube” in text will be replaced with this name instead.
The support_url is a URL where users can get support for their Roundcube installation. It
isn’t strictly needed, but it can be nice if Roundcube is being provided for a group of people
who may need assistance. If you don’t have a dedicated help desk site, you can use an email
address, like mailto:[email protected].
You can replace the Roundcube logo with skin_logo, which takes a URL to a PNG file
(178px by 47px). If you are going to enable HTTPS (highly recommended, and covered
later in this tutorial), then make sure the image URL is an HTTPS URL.
All other options can be left at their default values.
Database setup
Roundcube uses MySQL to store the information for running the web client (not your emails). In
this section, you need to tell Roundcube how to access the database that you set up in Step 4. You’ll
need the database user, user password, and database name you created previously.
It should be already set, but select MySQL from the Database type pull down menu.
Enter localhost for the Database server.
Enter the database name, roundcubemail, in the Database name field.
Enter the database user, roundcube, in the Database user name field.
For the Database password field, enter the password you defined when creating the
database in Step 4.
The last option, db_prefix, isn’t required unless you are with using a shared database with
other apps. If so then enter something like, rc_.
IMAP Settings
For this section, you’ll need the IMAP and SMTP settings for your email server. Because this
tutorial uses Gmail as an example, the Gmail settings are included below, but if you have your own
email provider, they should provide you with the details you need. Most email providers support
connections with or without encryption. Make sure to avoid using non-secure connections by using
the SSL IMAP/SMTP URLs and ports.
In the default_host field enter the IMAP server URL. When using SSL connections, prefix
the URL with ssl:// instead of https://. For Gmail, enter
ssl://imap.gmail.com.
1. Next is setting the default_port, which is the IMAP server port. SSL and non-SSL
connections will use different ports, so make sure to use the SSL port. Gmail’s SSL IMAP
port uses 993.
2. The field username_domain is a convenience option for email providers that use a full
email address as the username. This field is optional. Entering a domain — not the full email
— will allow you to login to Roundcube with just your name, before the @, instead of the
whole email. For example, entering gmail.com in the field will allow
[email protected] to log into Roundcube with user.
3. Make sure the auto_create_user check box is selected. If it’s unchecked, Roundcube won’t
create a user in its own database, which will prevent you from logging in.
4. For now, leave all of the *_mbox fields, like sent_mbox, with their default values. This can
be updated later in the Roundcube UI, and most email clients use these folder names
anyway.
SMTP Settings
The SMTP server is the part of email that sends emails. Much like the IMAP server section, we’ll
use the SSL URL and port, and Gmail for reference.
1. Enter the SMTP server address in the smtp_server field. Gmail’s SMTP server is
ssl://smtp.gmail.com.
2. Enter the SSL SMTP server port in the smtp_port field. The SSL port for Gmail is 465.
3. Because SMTP and IMAP are two separate services, they both need a username and
password. Roundcube gives us the option to use the IMAP username and password set
above so we don’t have to set it again here. This means you need to leave the fields under
smtp_user/smtp_pass blank and check the box next to Use the current IMAP username
and password for SMTP authentication.
4. Finally make sure that the checkbox for smtp_log is checked.
Plugins
Roundcube’s plugin support is what really makes this webmail client stand out. Below are a good
set of defaults you can install. All plugins are optional, i.e,. they aren’t necessary to use Roundcube,
but the list below is a good set to make the experience either easier or more secure.
Take a look at the descriptions for each plugin and install whichever you like. If you don’t select a
plugin here, you can always install it later. This just pre-configures Roundcube with these plugins.
archive: Gives you an Archive button, similar to how Gmail works.
emoticons: Simply makes it easier to use emoticons in emails.
enigma: Allows GPG email encryption. We’ll go into detail on how to configure this in our
Roundcube security tutorial.
filesystem_attachments: A core plugin to allow saving attachments to the Roundcube
server temporarily when composing or saving a draft email.
hide_blockquote: Hides the quoted portion of replied emails to keep the UI cleaner.
identity_select: If you have multiple email addresses (identities), it allows you to easily
select them while composing an email.
markasjunk: Allows marking an email as spam and have it moved to your Spam folder.
newmail_notifier: Uses your browser notification system to alert you to new emails.
At last, that’s all of the configuration. Press the UPDATE CONFIG button at the bottom of the
page to save your settings. Let’s test that everything works next.
Now you can visit your Roundcube instance using your server’s IP or your domain name, log in,
and check your email.
Conclusion
With Roundcube, you can have the feature set and appearance of a native desktop client with the
flexibility of a webmail client. You have a fully functional installation now, but there are some
additional steps you should take to make sure you’re fully secure (like adding HTTPS support and
using GPG encryption for your email). You can do this by following How to Secure Roundcube on
Ubuntu 16.04.
In addition, you can install new themes to enhance the look of your client and plugins to add new
functionality. Unlike plugins, there isn’t a central site to find themes, but you can find Roundcube
Skins or Roundcube forums as places to find some.
Generating a Certificate Signing Request (CSR)
Whether you are getting a certificate from a CA or generating your own self-signed certificate, the
first step is to generate a key.
If the certificate will be used by service daemons, such as Apache, Postfix, Dovecot, etc., a key
without a passphrase is often appropriate. Not having a passphrase allows the services to start
without manual intervention, usually the preferred way to start a daemon.
This section will cover generating a key with a passphrase, and one without. The non-passphrase
key will then be used to generate a certificate that can be used with various service daemons.
Running your secure service without a passphrase is convenient because you will not need to enter
the passphrase every time you start your secure service. But it is insecure and a compromise of the
key means a compromise of the server as well.
To generate the keys for the Certificate Signing Request (CSR) run the following command from a
terminal prompt:
openssl genrsa -des3 -out server.key 2048
You can now enter your passphrase. For best security, it should at least contain eight characters.
The minimum length when specifying -des3 is four characters. It should include numbers and/or
punctuation and not be a word in a dictionary. Also remember that your passphrase is case-
sensitive.
Re-type the passphrase to verify. Once you have re-typed it correctly, the server key is generated
and stored in the server.key file.
Now create the insecure key, the one without a passphrase, and shuffle the key names:
openssl rsa -in server.key -out server.key.insecure
mv server.key server.key.secure
mv server.key.insecure server.key
The insecure key is now named server.key, and you can use this file to generate the CSR without
passphrase.
To create the CSR, run the following command at a terminal prompt:
openssl req -new -key server.key -out server.csr
It will prompt you enter the passphrase. If you enter the correct passphrase, it will prompt you to
enter Company Name, Site Name, Email Id, etc. Once you enter all these details, your CSR will be
created and it will be stored in the server.csr file.
You can now submit this CSR file to a CA for processing. The CA will use this CSR file and issue
the certificate. On the other hand, you can create self-signed certificate using this CSR.
You can get the SSL certificate from a Certificate Issuing Authority or you can create self signed
SSL certificate. Please refer to Certificates for details about how to create self signed SSL
certificate. Once you create the certificate, you will have a key file and a certificate file that you
want to make known in the config shown above.
It is advisable to follow steps as it configure secure certificat for Dovecot as well.
sudo cp server.crt /etc/ssl/certs
sudo cp server.key /etc/ssl/private
https://www.digitalocean.com/community/tutorials/how-to-install-your-own-
webmail-client-with-roundcube-on-ubuntu-16-04
Installing Quota
This guide starts by installing the quota program using the following command:
apt-get install quota
The mount options of the file system need to be edited before user specific quotas can be used. The
mount file fstab needs to be opened for editing using the following command:
sudo nano /etc/fstab
The quotas are enabled by adding a usrquota and/or grpquota to the mounting options of the
main hard disk. When using ursquota, the quotas are only enabled on specific users. The grpquota
option allows for quotas on user groups.
Both options can be independently added depending on the desired result. The fstab file should
be edited as follows for enabling user quotas (for group quotas add grpquota).
LABEL=DOROOT / ext4 errors=remount-ro,usrquota 0 1
Save the file and enable the new mount options by remounting the file system as follows:
mount -o remount /
74
First install the module:
sudo apt-get install sshfs
Load it to kernel:
sudo modprobe fuse