RoundCube webmail installation on Debian 8 (Jessie)

This tutorial shows the installation of the latest RoundCube webmail on Debian 8. Roundcube is an easy to use webmail client with IMAP and SMTP support that can be extended with plugins. On Debian 7, RoundCube was available as .deb package, it was not the latest version but at least it was easy to install with apt. For the current Debian release, there is no RoundCube package available anymore so I'll describe the installation from source here. This tutorial contains an optional chapter that describes the steps to connect RoundCube with the ISPConfig 3 Hosting Control Panel.

Prerequisites

  • Debian 8 Operating System.
  • Apache web server with mod_php installed. If there is no apache installed yet, then take a look at our LAMP guide or Perfect Server setup to install a suitable environment.
  • An email server (SMTP + IMAP) were Roundcube shall connect to. This can be the local server (e.g. when you use one of the perfect server setups) or a remote server.
  • The server hostname that I will use in this tutorial is server1.example.com with the IP address 192.168.1.100. Please replace that with the IP and hostname of your server.

RoundCube Installation

I will install RoundCube into the directory /opt/roundcube to ensure that this installation will not collide with any Debian system packages. The first step is to install wget, create the directory /opt/roundcube and download the latest RoundCube version with wget into this directory. The current RoundCube version is 1.1.3 at the time that I write this tutorial, take a look at the RoundCube website to check if there is a later version that you can use.

Login as root user on the shell of your server, then install wget and the nano editor:

apt-get install wget nano

Create the directory and enter it with the "cd" command:

mkdir /opt/roundcube
cd /opt/roundcube

Download the RoundCube tar.gz file and unpack it:

wget https://downloads.sourceforge.net/project/roundcubemail/roundcubemail/1.1.3/roundcubemail-1.1.3-complete.tar.gz
tar xfz roundcubemail-1.1.3-complete.tar.gz

The RoundCube files are now in the folder /opt/roundcube/roundcubemail-1.1.3. The next step is to move them one directory up to /opt/roundcube.

mv roundcubemail-1.1.3/* .
mv roundcubemail-1.1.3/.htaccess .

The dot at the end of the two commands is required and part of the command, don't miss it! Delete the empty directory and the tar.gz file.

rmdir roundcubemail-1.1.3
rm roundcubemail-1.1.3-complete.tar.gz

And change the owner of all files to the user the Apache server is running as.

chown -R www-data:www-data /opt/roundcube

Install the RoundCube Database

Roundcube requires a database to store mailbox settings, contacts, etc. I will use MySQL (or MariaDB) here as database backend. We will now create a database with the name "roundcubemail" and a user with the name "roundcube" in MySQL.

Login to the MySQL server with the following command:

mysql --defaults-file=/etc/mysql/debian.cnf

Then execute the following commands on the MySQl database shell to create the database and database user. Replace the word "secretpassword" in the commands below with a password of your choice.

CREATE DATABASE roundcubemail;
GRANT ALL PRIVILEGES ON roundcubemail.* TO [email protected] IDENTIFIED BY 'secretpassword';
flush privileges;
quit

Now we will import the RoundCube tables from the file mysql.initial.sql into our new database.

Run the following command on the Linux shell:

mysql --defaults-file=/etc/mysql/debian.cnf roundcubemail < /opt/roundcube/SQL/mysql.initial.sql

Configure RoundCube and Apache

In this step, we will configure the database details in RoundCube and add a RoundCube configuration file in Apache.

I'll start with the database configuration in RoundCube. Run the following commands to create a new config.inc.php file based on the sample configuration file and open it in the nano editor.

cd /opt/roundcube/config
cp -pf config.inc.php.sample config.inc.php
nano config.inc.php

Find the database configuration line that starts with $config['db_dsnw'] and replace it with the following line:

$config['db_dsnw'] = 'mysql://roundcube:[email protected]/roundcubemail';

The word "secretpassword" has to be replaced with the password that you have chosen for the database.

Next search for the "smtp_server" line and set the hostname of your SMTP server here. In my case, the mail server is the local server, so I'll set the server to "localhost".

$config['smtp_server'] = 'localhost';

Now it's time to configure Apache. I'll create a new configuration file roundcube.conf in the folder /etc/apache2/conf-available/.

nano /etc/apache2/conf-available/roundcube.conf

Add the following lines to that file and save it.

Alias /roundcube /opt/roundcube
Alias /webmail /opt/roundcube

<Directory /opt/roundcube>
Options +FollowSymLinks
# AddDefaultCharset UTF-8
AddType text/x-component .htc

<IfModule mod_php5.c>
AddType application/x-httpd-php .php
php_flag display_errors Off
php_flag log_errors On
# php_value error_log logs/errors
php_value upload_max_filesize 10M
php_value post_max_size 12M
php_value memory_limit 64M
php_flag zlib.output_compression Off
php_flag magic_quotes_gpc Off
php_flag magic_quotes_runtime Off
php_flag zend.ze1_compatibility_mode Off
php_flag suhosin.session.encrypt Off
#php_value session.cookie_path /
php_flag session.auto_start Off
php_value session.gc_maxlifetime 21600
php_value session.gc_divisor 500
php_value session.gc_probability 1
</IfModule>

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^favicon\.ico$ skins/larry/images/favicon.ico
# security rules:
# - deny access to files not containing a dot or starting with a dot
# in all locations except installer directory
RewriteRule ^(?!installer)(\.?[^\.]+)$ - [F]
# - deny access to some locations
RewriteRule ^/?(\.git|\.tx|SQL|bin|config|logs|temp|tests|program\/(include|lib|localization|steps)) - [F]
# - deny access to some documentation files
RewriteRule /?(README\.md|composer\.json-dist|composer\.json|package\.xml)$ - [F]
</IfModule>

<IfModule mod_deflate.c>
SetOutputFilter DEFLATE
</IfModule>

<IfModule mod_expires.c>
ExpiresActive On
ExpiresDefault "access plus 1 month"
</IfModule>

FileETag MTime Size

<IfModule mod_autoindex.c>
Options -Indexes
</ifModule>

AllowOverride None
Require all granted
</Directory>

<Directory /opt/roundcube/plugins/enigma/home>
Options -FollowSymLinks
AllowOverride None
Require all denied
</Directory>

<Directory /opt/roundcube/config>
Options -FollowSymLinks
AllowOverride None
Require all denied
</Directory>

<Directory /opt/roundcube/temp>
Options -FollowSymLinks
AllowOverride None
Require all denied
</Directory>

<Directory /opt/roundcube/logs>
Options -FollowSymLinks
AllowOverride None
Require all denied
</Directory>

The 2 Alias lines in the first two lines make RoundCube available as /roundcube and /webmail on your server.

Enable the configuration and reload apache:

a2enconf roundcube
service apache2 reload

That's it, RoundCube is now fully installed on your server, and you can reach it on the server IP and hostname trough the aliases /roundcube and /webmail. The IP of my server is 192.168.1.100; for that I can open RoundCube with http://192.168.1.100/webmail

The RoundCube login.

Roundcube - the first page.

Installation of the ISPConfig RoundCube plugin (optional)

When your server has iSPConfig 3 installed, then it is highly recommended to install the ISPConfig RoundCube plugin. This allows your email users to manage their autoresponders, email filters and other mailbox settings from within RoundCube.

The ISPConfig 3 RoundCube plugin is connected to ISPConfig 3 with the ISPConfig remote API. To use this API, we need a remote user.

Login to ISPConfig as "admin" user.

To create such a user, go to System > User Management > Remote Users and click on the Add new user button:

Enter a Username and password for the new remote user. I'll choose the username "roundcube" and password "!fdWEacBOG1d".

The remote user setup allows a fine grained access control; the following functions have to be enabled:

  • Server functions
  • Client functions
  • Mail user functions
  • Mail alias functions
  • Mail spamfilter user functions
  • Mail spamfilter policy functions
  • Mail fetchmail functions
  • Mail spamfilter whitelist functions
  • Mail spamfilter blacklist functions
  • Mail user filter functions

Finally click on Save.

The next steps were performed on the shell of your server. Login as root user.

We will install now the ISPConfig SSL certificate into the SSL certificate store from Debian.

cp /usr/local/ispconfig/interface/ssl/ispserver.crt /usr/local/share/ca-certificates/
update-ca-certificates

Open the /etc/php5/cgi/php.ini file

nano /etc/php5/apache2/php.ini

Scroll down until you see the [openssl] section of the file and there you add the following line:

openssl.cafile=/etc/ssl/certs/ca-certificates.crt

Then restart apache.

service apache2 restart

To download the addon, install the Git client first.

apt-get install git

Get the latest version of the RoundCube ISPConfig plugin:

cd /tmp
git clone https://github.com/w2c/ispconfig3_roundcube.git
cd /tmp/ispconfig3_roundcube/

And move the plugin into the roundcube plugin directory.

mv ispconfig3_* /opt/roundcube/plugins
cd /opt/roundcube/plugins

Create a new config.inc.php file for the plugin based on the sample configuration and open the file in the nano editor.

mv ispconfig3_account/config/config.inc.php.dist ispconfig3_account/config/config.inc.php
nano ispconfig3_account/config/config.inc.php

Fill in the details of the remote user and save the file.

<?php
$rcmail_config['identity_limit'] = false;
$rcmail_config['remote_soap_user'] = 'roundcube';
$rcmail_config['remote_soap_pass'] = '!fdWEacBOG1d';
$rcmail_config['soap_url'] = 'https://server1.example.com:8080/remote/';
?>

Replace server1.example.com with the hostname of the server. When SSL (HTTPS) is used for the Remote API connection, then it is important that the hostname in the RoundCube configuration matches the hostname of the SSL certificate of the ISPConfig interface. You can check the hostname of the ISPConfig SSL certificate with the command:

openssl x509 -in /usr/local/share/ca-certificates/ispserver.crt -text -noout | grep Subject:

The result is in my case:

Subject: C=DE, ST=Niedersachsen, L=Lueneburg, O=ISPConfig UG, OU=IT, [email protected]

So the hostname "server1.example.com" in the plugin configuration file matches the hostname in the SSL certificate.

Now we'll activate the new plugins in RoundCube. Open the configuration file in an editor:

nano /opt/roundcube/config/config.inc.php

and add the following line at the end of the file:

$rcmail_config['plugins'] = array("jqueryui", "ispconfig3_account", "ispconfig3_autoreply", "ispconfig3_pass", "ispconfig3_spam", "ispconfig3_fetchmail", "ispconfig3_filter");

Now you can login to RoundCube, the new options can be found under Settings > Account.

General account.

Mail filter setup.

Fetchmail setup.

Share this page:

43 Comment(s)

Add comment

Comments

From: Bradley Gillap

My certificate doesn't have a hostname. How do I create a certificate without breaking everything in ispconfig?

Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd

 

From: till
From: Bradley Gillap

Okay my certificate is better now and I ran through the steps again but I'm still getting Soap Error: Could not connect to host.

I have everything exactly as explained in your article with the exception of using fpm instead of cgi but I also made sure to modify the php.ini in the fpm folder properly.  

 

Any other ideas or ways I can troubleshoot this?

From: till

This tutorial uses mod_php and not cgi PHP. The error " Could not connect to host." means that the SOAP endoint that you configured in the configuration file is not reachable, you either used a wrong IP address or a subdomain that does not exist in DNS.

From: Bradley Gillap

Thank you for your continued support. Does the certificate have to be signed by an authority? Or am I fine to just continue using the one I generated using your referenced website?

From: till

No. You just have to tell PHP that this certificate root is valid. This step is done by editing the php.ini file as described in the tutorial.

From: Nimer

It's simple :) - you need to change the way plugins are connecting to SOAP:(ie. /opt/roundcube/plugins/ispconfig3_account/ispconfig3_account.php L:13)        $this->soap = new SoapClient(null, array('location' => $this->rcmail_inst->config->get('soap_url') . 'index.php',                                                 'uri'      => $this->rcmail_inst->config->get('soap_url'),                                                 'trace'    => 1,                                                 'stream_context'=> stream_context_create(array('ssl'=> array('verify_peer'=>false,'verify_peer_name'=>false)))

        ));But you must do this for every single plugin...

From: till

Thats only necessary when you use a self-signed SSL certificate and don't import the ispconfig cert as described above. Your approach is an alternative to the setup above but not necessary when you follow this tutorial.

From: Nimer

till - well i tried to follow this tutorial and triple checked every single step regarding certificate etc. (And yes i checked cert params, import...). But i wasnt able to get it to work on Debian jessie php 5.6. So let's say, its a workaround. I've seen too many people having trouble with this.

From: Dainel

The only way that worked for me, has been editing the plugin. There are several sites reporting this error, but only editing the files to solve. (in my environment)

From: Gordon Fielden

The following doesn't work, when go to setting after loading the setting tab its blank

 

The files has a plugin setting but with the following command

$config['plugins'] = array(    'archive',    'zipdownload',   

$rcmail_config['plugins'] = array("jqueryui", "ispconfig3_account", "ispconfig3_autoreply", "ispconfig3_pass", "ispconfig3_spam", "ispconfig3_fetchmail", "ispconfig3_filter");

From: till

Compare your line again with the one of the tutorial, what you posted is not the one from this guide.

From: Christopher

Hi Till,

one more great tutorial, thanks!

What about moving $rcmail_config to $config - as is in actual Roundcube installation ($rcmail_config is pre 1 style)?

 

Oh, and I do have problems with this tinyMCE installation here to add comments: my Firefox 42 is not resolving the necessary javascript, so instead of filling the textarea with an editable "virtual" iframe, it just blanks it out :-( I needed to switch to Chrome for a pitty.

From: Eolo2000

Hi Till!

I'm having same problem with certificate, it doesn't have a hostname.

Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd

After trying to send a mail I receive this error:  smtp error (-1) connection to server failed

I have installed twice over this tutorial:

The Perfect Server - Debian 8 Jessie (Apache2, BIND, Dovecot, ISPConfig 3)

Same result.

Thanks!

From: till

Enter the hostname while you create the SSL certificate, then the cert has a hostname.

From: Ian Jhon Bien

Hi, if there's a tutorial how to install roundcube email for ispconfig3 on centos 6?? thanks

From: Jesse Norell

should link to this tutorial at http://www.ispconfig.org/page/en/documentation.html

From: Jenny Hopkins

Thanks for this - worked like a dream!

From: pat

fololowed the tutorial and i'm able to login. only problem is that if i'm  logged in, settings - account - every submenue shows me a "Soap Error: Bad Request". The yutoreply seems to run forever. due to the error i can't make an entry (for mailfiler for example).

is there something i can check ?

From: pat76

spent some time until i found the hint that solved my problem. i followed the "The Perfect Server - Debian 8 Jessie (Apache2, Bind, Dovecot, ISPConfig 3" before i started this howto.

To get things working i had to add the first two lines written in italic to my .htaccess file:

[email protected]:/usr/local/ispconfig/interface# cat /usr/local/ispconfig/interface/web/.htaccessRequire host <myhostname>Require ip <myIP>AuthType BasicAuthName "Login"AuthUserFile /usr/local/ispconfig/interface/.htpasswdrequire valid-userProbably it would be woth mention that so that others won't have the same issue.

From: till

There is no file /usr/local/ispconfig/interface# cat /usr/local/ispconfig/interface/web/.htaccess in ISPConfig by default. If you created one to protect yur ispconfig with a second auth layer, then you have to enable access for the remote api in your manually added .htaccess file off course.

From: deimos

in debian 8 howto will not function on port 465 is an mistake insert in config.inc.php: $config['smtp_server'] = 'localhost';

let var emtpy localhost is defined in: $config['default_host'] = 'localhost'; after install then roundcube send on port 465

 

From: vikozo

Hello

it works fine for me too, thanks for this tutorial!

i just have a problemwhen you go to Einstellung (configruation)then to Konto

i go a error "Soap Error: Could not connect to host"

but sending and getting email, addressbook and so works fine

have a nice dayvinc

From: Manlove

Make sure the following line in ispconfig3_account/config/config.inc.php

   $rcmail_config['soap_url'] = 'https://server1.example.com:8080/remote/';

has https and not http which is the default.

From: nikolaosp

Hi,

 

thanks again for a brilliant guide, however I have some issues.  I receive a 403 error (Forbidden) whenever I try to access http://my.ip/roundcube or http://my.ip/webmail.  On the apache2 error log I see  AH01630: client denied by server configuration: /var/www/webmail and  AH01630: client denied by server configuration: /var/www/roundcube

How can I resolve this?

Thanks.

From: mccharlet

Hi,

How to configure roundcubemail for https  only?

From: broo

For those who have a problem with SOAP ERROR

 

You must add line

openssl.cafile=/etc/ssl/certs/ca-certificates.crt

into the /etc/php5/apache2/php.ini

 

From: NicoLagaffe

First i have regenerate a SSL certificate for ISPconfig with FQDN hostname of server by run the script update.php in ISPconfig install folder.

Second i apply this tutorial. I use Roundcube in a subdomain with PHP-FPM. This tuto work fine if i add this line in /etc/php5/fpm/php.ini (see below).

No SOAP error or Could not connect message.

Thanks and sorry for my poor english.

openssl.cafile=/etc/ssl/certs/ca-certificates.cr

From: Joe

hii have an server installed with this tutorial : https://www.howtoforge.com/tutorial/perfect-server-debian-8-jessie-apache-bind-dovecot-ispconfig-3/

All worked fine. I followed your tutorial and it works. roundcube works perfact and also the ispconfig plugin works in roundcube

But now i have an problem in ISPCONFIG on the Email Tab. when i click on e-mail the left side menu loads but i see the last Content (for example serverstat). this is only in the email tab. all other worked fine system, sites, client ...

any idea what is gone broken?

From: till

Just a guess: You created a alias /mail for roundcube instead of /webmail. The /mail alias that you created redirects the requests of the mail tab in ispconfig to RoundCube now. Change the alias in apache to /webmail and restart apache to fix the issue.

From: Raziel

Very important !

Do not forget to set  "$config['des_key']" in your config.inc.php file.

From: Csaba Mikoczy

Dear till!

How should i start if i try to make roundcube work on an ispconfig server that i just upgraded from wheezy, and had roundcube before (by your previous guide)?

From: Csaba Mikoczy

Hello till!

How should i start if i want to install roundcube on a server that i just upgraded from wheezy to jessie, and it had had a working roundcube before the upgrade per your previous guide (Using RoundCube Webmail With ISPConfig 3 On Debian Wheezy (Apache2))?

 

From: mintess

As this tutorial won't work for every multiserver setup (where the certificate must not be the one from the local server) and I just spent 2 hours finding out what's going on, you might find this useful if- you have a Multiserver Setup- you get a Soap error connecting to the host (using https to connect to the API)- running the webmailer in http is not an option for you- importing the other server's certificate (the one with the main dbispconfig database) and updating using update-ca-certificates failed

the only solution for me was to replace the initialization of the new SoapClient in the 9 ispconfig plugin files (/opt/roundcube/plugins/ispconfig3_*) to:

$this->soap = new SoapClient(null, array('location' => $this->rcmail_inst->config->get('soap_url') . 'index.php', 'uri'=> $this->rcmail_inst->config->get('soap_url'),'stream_context' => stream_context_create(array('ssl'=> array('verify_peer'=>false,'verify_peer_name'=>false)))));

From: Jesse Norell

FWIW, jessie-backports does have a roundcube package if anyone prefers that.

From: till

Good to know. I was not aware of that :)

From: AngelDust

hello i have question about multi-card ss certyficat in roundcube . If i don't implement my premum ssl and using with isp ssl certyfication plugins in roundcube work fine. But when i change with my plugins send ERROR: no connection to server. i know this is problem with sopa url in config.inc.php . My certyficat CN = .*mydomain.com but in ispconfig CN=mailserver.maindomain.com and in soap url is ok if he see that  CN = mailserver.maindomain.com $rcmail_config['soap_url'] = 'https://mailserver.maindomain.com:8080/remote/'; Roundcube plugins work fine !!! but self ssl is bad idea i have premium multi domain ssl . And now my question is what i can add here if my CN = .*maindomain.com $rcmail_config['soap_url'] = 'https://what need here :8080/remote/'; 

From: AngelDust

  i know this is problem with sopa url in config.inc.php . My certyficat CN = .*mydomain.com but in ispconfig CN=mailserver.maindomain.com and in soap url is ok if he see that  CN = mailserver.maindomain.com $rcmail_config['soap_url'] = 'https://mailserver.maindomain.com:8080/remote/'; Roundcube plugins work fine !!! but self ssl is bad idea i have premium multi domain ssl . And now my question is what i can add here if my CN = .*maindomain.com $rcmail_config['soap_url'] = 'https://what need here :8080/remote/'; 

From: John G

Hi. I have a question regarding password plugin for roundcube. If both email and web server resides on the same machine the plugin setup is quite clear:

$config['password_db_dsn'] = 'mysql://userdb:[email protected]/dbispconfig';

and 

$config['password_query'] = 'UPDATE mail_user SET password = %c WHERE email = %u LIMIT 1';

In my case roundcube resides on a separate server than email server, in a multiserver ISPConfig setup.

So there are two mysql databases that must by updated in the same time.

Can anyone help with this? How to change the config.inc.php and sql.php (from drivers sub-folder) in order to accomplish this task?

Thank you!

From: till

Use the ispconfig roundcube plugin (which uses the correct way to connect to ISPConfig with the remote api) and not a plugin that messes with MySQl directly.

From: Nicolo

Hey :)

Thanks for your tutorial.

I have a little problem. When i go to my website https://192.168.x.xxx/webmail

I have a little error:

DATABASE ERROR: CONNECTION FAILED! Unable to connect to the database!Please contact your server-administrator.   And i can't finde the mistake  Can you help me?   Thank you!

From: computerwuffi

Hallo Till,

sehr ausführliches und gutes Tutorial. Ich möchte aber kurz fragen, ob das ganze auch für ISPConfig 3.1 funktioniert?

From: till

As far as I know, the author of the roundcube ISPConfig plugin did not adjust it for ISPConfig 3.1 yet. But you might find more up to date information on the Github page of the roundcube plugin.