Setup Roundcube Webmail on CentOS Linux

Setup Roundcube Webmail on CentOS Linux
– Install Centos 7
– Configure networking
– Disable selinux
– Uninstall sendmail

systemctl stop sendmail
systemctl disable sendmail
yum remove -y sendmail

– Install php

yum install -y php

– Enable EPEL repository:

cd /tmp
wget wget
rpm -ivh epel-release-latest-7.noarch.rpm

– Enable the REMI repository (for ImageMagick, etc):

cd /tmp
rpm -ivh remi-release-7.rpm
vi /etc/yum.repos.d/remi-php54.repo (set "enabled=1" - because the current system has PHP version 5.4 installed. There are repo files for other PHP versions in the same directory)

– Add both the email domain name and the server’s FQDN as aliases to the “” entry in file /etc/hosts
– Add another line to /etc/hosts for the server’s primary IP address mapping it to its short name and its FQDN
# cat /etc/hosts localhost localhost.localdomain localhost4 localhost4.localdomain4 myserver1

– Allow incoming/outgoing connections through the firewall for apps:

firewall-cmd --permanent --zone=public --add-service=http
firewall-cmd --permanent --zone=public --add-service=https
firewall-cmd --permanent --zone=public --add-service=imap
firewall-cmd --permanent --zone=public --add-service=imaps
firewall-cmd --permanent --zone=public --add-service=pop3s
firewall-cmd --permanent --zone=public --add-service=smtp
firewall-cmd --permanent --zone=public --add-service=smtps
firewall-cmd --permanent --zone=public --add-service=dns
firewall-cmd --reload

– Configure Postfix

yum install -y postfix
systemctl enable postfix
yum update postfix
systemctl start postfix
systemctl status postfix

– Configure Postfix

cd /tmp
openssl req -x509 -nodes -newkey rsa:2048 -keyout mailserver.key -out mailserver.crt -nodes -days 730
mkdir /etc/postfix/ssl
mv mailserver.key /etc/postfix/ssl
mv mailserver.crt /etc/postfix/ssl
chmod -R 660 /etc/postfix/ssl
vi /etc/postfix/ (uncomment the following lines)
#submission inet n - n - - smtpd
# -o syslog_name=postfix/submission
# -o smtpd_tls_security_level=encrypt
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
vi /etc/postfix/ (uncomment the myhostname variable and set its value to the server's hostname)

vi /etc/postfix/ (uncomment the mydomain variable and set it to the domain to receive emails for)

vi /etc/postfix/ (uncomment the following lines)
#inet_interfaces = all
#inet_interfaces = localhost
#inet_protocols = all
#mydestination = $myhostname, localhost.$mydomain, localhost
#home_mailbox = Maildir/

vi /etc/postfix/ (add the following lines to the end of the file)
smtpd_tls_key_file = /etc/postfix/ssl/mailserver.key
smtpd_tls_cert_file = /etc/postfix/ssl/mailserver.crt
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

– Change the home_mailbox parameter for Postfix in file /etc/postfix/ to match the dovecot config as follows (uncomment if necessary):

home_mailbox = Maildir/

– Add the hostname and domainname to mydestination parameter in the Postfix configuration file /etc/postfix/ or you will get the “mail loops back to myself” error when attempting to send to local users.

mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain

– Restart postfix:

systemctl restart postfix
systemctl status postfix

– Test Postfix with telnet (send a test mail to another local user then check that user’s /home/username/Maildir/new/ directory for the mail file)

yum install -y telnet
telnet localhost 25

– Install and Configure Dovecot

yum install -y dovecot
systemctl enable dovecot
systemctl start dovecot
systemctl status dovecot

Edit config file /etc/dovecot/dovecot.conf and uncomment the line below:

protocols = imap pop3 lmtp

– Edit the file /etc/dovecot/conf.d/10-auth.conf and set the following parameters (also uncomment them as well):

disable_plaintext_auth = no
auth_mechanisms = plain login

– Edit the file /etc/dovecot/conf.d/10-master.conf and set the following section to:

unix_listener auth-userdb {
#mode = 0666
user = postfix
group = postfix

– Set the dovecot mail_location parameter in the file /etc/dovecot/conf.d/10-mail.conf  (Uncomment the line and change the value).

mail_location = maildir:~/Maildir

– Configure dovecot for pop3 via the file /etc/dovecot/conf.d/20-pop3.conf (Uncomment or add the following lines):

pop3_uidl_format = %08Xu%08Xv
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh

– Restart dovecot to activate all the configuration changes:

systemctl restart dovecot

– Create the Maildir folder in the skeletons folder so that future users are created with the folder automatically (manually create it for all existing users and change the ownership accordingly)

mkdir -p /etc/skel/Maildir/{cur,new,tmp}

– Install and configure fetchmail and procmail (if required)

yum install -y fetchmail
yum install -y procmail
which procmail

– Install and Configure Apache webserver

yum install -y httpd
systemctl enable httpd
systemctl start httpd
systemctl status httpd

– Edit the file /etc/{nginx,apache2,httpd}/etc/httpd/conf.d/ssl.conf and change X-Frame-Options to SAMEORIGIN. For example, the line “Header always set X-Frame-Options DENY” becomes “Header always set X-Frame-Options SAMEORIGIN”
Note that without this change sending appears to hang (spins but a refresh shows the mail in the Sent folder, AND more importantly, attempts to attach files to the mail throws an error and faiils).

– Install Roundcube

yum install -y mysql mariadb-server php php-common php-json php-xml php-mbstring
systemctl enable mariadb
systemctl start mariadb
systemctl status mariadb
mysql -u root -p (Just press ENTER when prompted for the password)
MariaDB [(none)]> create database roundcube_db;
MariaDB [(none)]> grant all on roundcube_db.* to roundcube_user@localhost identified by 'roundcube_db_password';
MariaDB [(none)]> select user from  mysql.user;
MariaDB [(none)]> quit

NOTE: substitute your own username and password for “roundcube_user” and “roundcube_db_password” in the “grant” command above.

cd /var/www/html/
tar -zxvf roundcubemail-1.3.7-complete.tar.gz
mv roundcubemail-1.3.7 roundcube
chown -R apache:apache roundcube

– Install various PHP extensions (that are not installed by default)

yum install -y php-pdo
yum install -y php-intl
yum install -y php-gd
yum install -y php-pear
yum install -y php-pecl-imagick
yum install -y php-mysql
yum install -y php-ldap

– Set your timezone in /etc/php.ini (e.g., add the following line to the file)


– Restart Apache webserver to detect the changes:

systemctl restart httpd

– Complete the install by using the URL http://servername-or-ip/roundcube/installer
– 1. Check environment – install any missing but required PHP extensions, DB, etc
– 2. Create config – make changes as required to various config options including the database parameters (name, user, user password – created earlier). At the end, click the “Create Config” button which creates and stores the config file in the roundcube config directory (/var/www/html/roundcube/config/). Click the “CONTINUE” button.
– 3. Test config – test that roundcube can connect login to the IMAP (dovecot) and SMTP (Postfix) servers successfully
– Click the “Initialize database” button
– Scroll down and “Test SMTP config” by supplying sender/recipient email addresses
– Then “Test IMAP config” by supplying the username and password of a local user account

– 4. Delete the installer directory (or move the directory outside /var/www/html/) to prevent reconfiguration and/or unauthorized access:

rm -rf /var/www/html/roundcube/installer

– 5. Enable Roundcube’s automatic cache-cleaning (optional but recommended):

sudo crontab -u apache -l | { cat; echo "18 11 * * * /var/www/html/roundcube/bin/"; } | sudo crontab -u apache -

– 6. Confirm that the parameter default_host in the Roundcube config file /var/www/html/roundcube/config/ is set to the email domain name.

$config['default_host'] = '';

– 7. Optional: default maximum attachment size is 2MB. To increase this value, edit file /etc/php.ini and increase the value of the parameter upload_max_filesize (default is 2M) to your desired size then restart the Apache webserver:

upload_max_filesize = 6M

– 8. Restart Apache webserver:

systemctl restart httpd


– Optionally Enable SSL for extra security

yum install mod_ssl
mkdir /etc/httpd/ssl
openssl req -x509 -nodes -days 1095 -newkey rsa:2048 -out /etc/httpd/ssl/server.crt -keyout /etc/httpd/ssl/server.key
openssl dhparam -out /etc/httpd/ssl/dhparam.pem 2048
cat /etc/httpd/ssl/dhparam.pem | tee -a /etc/httpd/ssl/server.crt
chmod -R 660 /etc/httpd/ssl

– Edit mod_ssl config file /etc/httpd/conf.modules.d/ssl.conf
vi /etc/httpd/conf.d/ssl.conf

– Find the section that begins with “<VirtualHost _default_:443>” and uncomment the 2 lines below. Also change the ServerName parameter to your server’s name/IP
DocumentRoot “/var/www/html”

– Find the SSLProtocol and SSLCipherSuite lines and either delete them or comment them out.

– Find the SSLCertificateFile and SSLCertificateKeyFile lines and change them to the paths to the SSL keys we created earlier:

SSLCertificateFile /etc/httpd/ssl/server.crt
SSLCertificateKeyFile /etc/httpd/ssl/server.key

– Paste in the lines below AFTER the end of the VirtualHost block (after “”):

SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains"
Header always set X-Frame-Options DENY
Header always set X-Content-Type-Options nosniff
SSLCompression off
SSLUseStapling on
SSLStaplingCache "shmcb:logs/stapling-cache(150000)"

– For additional security, redirect all traffic to be SSL encrypted. Create the file /etc/httpd/conf.d/non-ssl.conf with the content below (use your own servername or IP-address):

vi /etc/httpd/conf.d/non-ssl.conf

<VirtualHost *:80>
     Redirect "/" ""

– Restart Apache webserver:
systemctl restart httpd



For nginx (webserver):


– Fetchmail does not seem to come with control scripts, but if you create them yourself (under /etc/init.d and links to /etc/rc.d/rcX.d/), systemd will pick them up

– Sample Fetchmail config that downloads mails for 3 users (5 minutes interval) from a remote mail server (IP n.n.n.n or FQDN)

# cat /root/.fetchmailrc
set syslog
set no bouncemail
set no spambounce
set daemon 300
poll n.n.n.n
with proto pop3
    username password Password@123 is localuser1 mda "/bin/procmail -d %T"
    username password my-Password@123 is localanotheruser mda "/bin/procmail -d %T"
    username password justaPassword is localeusername mda "/bin/procmail -d %T"

– Fetchmail knows to use /root/.fetchmailrc because it is defined in its startup script:
# grep fetchmailrc /etc/init.d/fetchmail

– If you use a relayhost (i.e., your mail server can’t send mails directly), uncomment and set the relayhost variable to your service provider’s SMTP server (and port e.g., 587) – especially necessary if they are blocking TCP port 25.
See link for sample steps for postfix:
The default postfix/fetchmail/dovecot log on CentOS/RedHat/Oracle_Linux is /var/log/maillog (look in the file for troubleshooting)

– If you have mails in /var/mail/ (e.g., because you were using Sendmail before) and you want that mail to be accessible in Roundcube or other email clients such as Outlook, you may need to use the mbox format instead of the Maildir folder, i.e., change the mail_location in file /etc/dovecot/conf.d/10-mail.conf as follows.

NOTE: If you switch to the mbox format, make sure the permission on INBOX files in /var/mail/ is 0600

  • If you would rather “migrate” the old mails in mbox format to the Maildir format (recommended for Postfix/Dovecot), you may need to use the mb2md utility.
    The mail_location in dovecot’s configuration remains as before:
    # grep mail_location  /etc/dovecot/conf.d/10-mail.conf
    mail_location = maildir:~/Maildir
    # Install mb2md mail formatconverter utility
    yum install -y mb2md-3.20-17.el7.noarch# Migrate each existing user’s old mails with the command below:
    su – <username>
    mb2md -m -d ~/Maildir/

    # NOTE: I tried both dsync and doveadm for the migration but got inconsistent results – not all mails were migrated or the commands just errored out with a core dump.

Refence link:

This entry was posted in Uncategorized and tagged , , , , , , , , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s