Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

Link zu dieser Vergleichsansicht

Nächste Überarbeitung
Vorhergehende Überarbeitung
centos:mail_c7:roundcube_1 [09.09.2014 18:08. ] – angelegt djangocentos:mail_c7:roundcube_1 [18.11.2024 19:10. ] (aktuell) – Externe Bearbeitung 127.0.0.1
Zeile 7: Zeile 7:
 Im Detail sind das folgende Pakete: Im Detail sind das folgende Pakete:
   * **php-pspell**    * **php-pspell** 
 +  * **aspell-de**
   * **php-mcrypt**   * **php-mcrypt**
   * **GraphicsMagick**   * **GraphicsMagick**
  
-   # yum install php-pspell php-mcrypt GraphicsMagick -y+   # yum install php-pspell aspell-de php-mcrypt GraphicsMagick -y
  
-/* Für die deutsche Rechtschreibkorrektur gibt es unter CentOS 7.x (noch)((Stand: September 2014)) kein RPM. Wir können jedoch das passende Paket aus dem Fedora-Zweig verwendenDas Paket [[http://ftp.tu-chemnitz.de/pub/linux/fedora/linux/releases/18/Everything/x86_64/os/Packages/a/aspell-de-20030222-9.fc18.x86_64.rpm|aspell-de]] holen wir daher auf unseren Rechner.+Für die deutsche Rechtschreibkorrektur gibt es im [[centos:epel7|EPEL-Repository]] für CentOS 7.x (noch)((Stand: September 2014)) kein RPM. Abhilfe schafft hier das [[centos:nausch.org|Repository nausch.org]]. Haben wir das **[[centos:nausch.org|nausch.org Repository]]** eingebunden wir das Paket **aspell-de** automatisch bei der Installation mit dem obigen Aufruf installiert. 
 + 
 +Alternativ kann man natürlich acu das Paket manuell installieren. Hierzu laden wir das Paket [[http://repo.nausch.org/7/x86_64/aspell-de-20030222-1.el7.centos.x86_64.rpm|aspell-de-20030222-1.el7.centos.x86_64.rpm]] auf unseren Rechner.
    # cd /usr/local/src/packages/    # cd /usr/local/src/packages/
  
-   # wget http://ftp.tu-chemnitz.de/pub/linux/fedora/linux/releases/18/Everything/x86_64/os/Packages/a/aspell-de-20030222-9.fc18.x86_64.rpm+   # wget http://repo.nausch.org/7/x86_64/aspell-de-20030222-1.el7.centos.x86_64.rpm
  
-Anschließend installieren wir dieses RPM. +Anschließend installieren wir dieses RPM mit Hilfe von **yum**
-   # yum install --nogpgcheck localinstall /usr/local/src/packages/aspell-de-20030222-9.fc18.x86_64.rpm+   # yum localinstall --nogpgcheck aspell-de-20030222-1.el7.centos.x86_64.rpm
  
 Wie immer kann man sich mit Hilfe des Aufrufes **rpm -qil <Paketname>** anzeigen lassen, was jedes einzelne Paket mit in das System gebracht hat. Wie immer kann man sich mit Hilfe des Aufrufes **rpm -qil <Paketname>** anzeigen lassen, was jedes einzelne Paket mit in das System gebracht hat.
-*/+ 
 +==== Installation roundcube ==== 
 +Die Installation von Roundcube selbst ist kein Hexenwerk, braucht man doch nur das entsprechende RPM-Paket mit Hilfe von **yum** installieren. 
 +   # yum install roundcubemail -y 
 + 
 +==== Installations-/Konfigurationsdokumentation ==== 
 +Im RPM finden wir eine ausführliche Dokumentation zur Konfiguration von **roundcubemail**  
 +   # cat /usr/share/doc/roundcubemail-1.0.2/INSTALL 
 + 
 +<file /usr/share/doc/roundcubemail-1.0.2/INSTALL>INTRODUCTION 
 +============ 
 + 
 +This file describes the basic steps to install Roundcube Webmail on your 
 +web server. For additional information, please also consult the project'
 +wiki page at http://trac.roundcube.net/wiki 
 + 
 + 
 +REQUIREMENTS 
 +============ 
 + 
 +* The Apache, Lighttpd, Cherokee or Hiawatha web server 
 +* .htaccess support allowing overrides for DirectoryIndex 
 +* PHP Version 5.2.1 or greater including 
 +   - PCRE, DOM, JSON, XML, Session, Sockets (required) 
 +   - PHP Data Objects (PDO) with driver for either MySQL, PostgreSQL or SQLite (required) 
 +     Note: MySQL database driver requires PHP 5.3.7 or newer. 
 +   - Libiconv (required) 
 +   - Multibyte String (mbstring) 
 +   - Mcrypt (supporting Triple DES) 
 +   - Fileinfo (optional) 
 +   - Zip (recommended) 
 +* PEAR packages distributed with Roundcube or external: 
 +   - Mail_Mime 1.8.1 or newer 
 +   - Mail_mimeDecode 1.5.5 or newer 
 +   - Net_SMTP (latest from https://github.com/pear/Net_SMTP/
 +   - Net_IDNA2 0.1.1 or newer 
 +   - Auth_SASL 1.0.6 or newer 
 +   - Net_Sieve 1.3.2 or newer (for managesieve plugin) 
 +   - Crypt_GPG 1.2.0 or newer (for enigma plugin) 
 +* php.ini options (see .htaccess file): 
 +   - error_reporting E_ALL & ~E_NOTICE (or lower) 
 +   - memory_limit > 16MB (increase as suitable to support large attachments) 
 +   - file_uploads enabled (for attachment upload features) 
 +   - session.auto_start disabled 
 +   - zend.ze1_compatibility_mode disabled 
 +   - suhosin.session.encrypt disabled 
 +   - mbstring.func_overload disabled 
 +   - magic_quotes_runtime disabled 
 +   - magic_quotes_sybase disabled 
 +   - register_globals disabled (PHP < 5.4) 
 +* PHP compiled with OpenSSL to connect to IMAPS and to use the spell checker 
 +* A MySQL (4.0.8 or newer), PostgreSQL, MS SQL Server (2005 or newer) database engine 
 +  or SQLite support in PHP 
 +* One of the above databases with permission to create tables 
 +* An SMTP server (recommended) or PHP configured for mail delivery 
 + 
 + 
 +INSTALLATION 
 +============ 
 + 
 +1. Decompress and put this folder somewhere inside your document root 
 +2. Make sure that the following directories (and the files within) 
 +   are writable by the webserver 
 +   - /temp 
 +   - /logs 
 +3. Create a new database and a database user for Roundcube (see DATABASE SETUP) 
 +4. Point your browser to http://url-to-roundcube/installer/ 
 +5. Follow the instructions of the install script (or see MANUAL CONFIGURATION) 
 +6. After creating and testing the configuration, remove the installer directory 
 +7. Check Known Issues section of this file 
 +8. Done! 
 + 
 + 
 +CONFIGURATION HINTS 
 +=================== 
 + 
 +Roundcube writes internal errors to the 'errors' log file located in the logs 
 +directory which can be configured in config/config.inc.php. If you want ordinary 
 +PHP errors to be logged there as well, enable the 'php_value error_log' line 
 +in the .htaccess file and set the path to the log file accordingly. 
 + 
 +By default the session_path settings of PHP are not modified by Roundcube. 
 +However if you want to limit the session cookies to the directory where 
 +Roundcube resides you can uncomment and configure the according line 
 +in the .htaccess file. 
 + 
 + 
 +DATABASE SETUP 
 +============== 
 + 
 +Note: Database for Roundcube must use UTF-8 character set. 
 + 
 +* MySQL 
 +------- 
 +Setting up the mysql database can be done by creating an empty database, 
 +importing the table layout and granting the proper permissions to the 
 +roundcube user. Here is an example of that procedure: 
 + 
 +# mysql 
 +> CREATE DATABASE roundcubemail /*!40101 CHARACTER SET utf8 COLLATE utf8_general_ci */; 
 +> GRANT ALL PRIVILEGES ON roundcubemail.* TO roundcube@localhost 
 +    IDENTIFIED BY 'password'; 
 +> quit 
 + 
 +# mysql roundcubemail < SQL/mysql.initial.sql 
 + 
 +Note 1: 'password' is the master password for the roundcube user. It is strongly 
 +recommended you replace this with a more secure password. Please keep in 
 +mind: You need to specify this password later in 'config/db.inc.php'
 + 
 + 
 +* SQLite 
 +-------- 
 +Versions of sqlite database engine older than 3 aren't supported. 
 +Database file and structure is created automatically by Roundcube. 
 +Make sure your configuration points to some file location and that the 
 +webserver can write to the file and the directory containing the file. 
 + 
 + 
 +* PostgreSQL 
 +------------ 
 +To use Roundcube with PostgreSQL support you have to follow these 
 +simple steps, which have to be done as the postgres system user (or 
 +which ever is the database superuser): 
 + 
 +$ createuser -P roundcube 
 +$ createdb -O roundcube -E UNICODE roundcubemail 
 +$ psql -U roundcube -f SQL/postgres.initial.sql roundcubemail 
 + 
 +Note: in some system configurations you might need to add '-U postgres' to 
 +createuser and createdb commands. 
 + 
 + 
 +* Microsoft SQL Server 
 +---------------------- 
 +Language/locale of the database must be set to us_english (1033). More info 
 +on this at http://trac.roundcube.net/ticket/1488918. 
 + 
 + 
 +Database cleaning 
 +----------------- 
 +To keep your database slick and clean we recommend to periodically execute 
 +bin/cleandb.sh which finally removes all records that are marked as deleted. 
 +Best solution is to install a cronjob running this script daily. 
 + 
 + 
 +MANUAL CONFIGURATION 
 +==================== 
 + 
 +First of all, copy the sample configuration file config/config.inc.php.sample 
 +to config/config.inc.php and make the necessary adjustments according to your 
 +environment and your needs. More configuration options can be copied from the 
 +config/defaults.inc.php file into your local config.inc.php file as needed. 
 +Read the comments above the individual configuration options to find out what 
 +they do or read http://trac.roundcube.net/wiki/Howto_Install for even more 
 +guidance. 
 + 
 +You can also modify the default .htaccess file. This is necessary to 
 +increase the allowed size of file attachments, for example: 
 +        php_value       upload_max_filesize     2M 
 + 
 + 
 +UPGRADING 
 +========= 
 + 
 +If you already have a previous version of Roundcube installed, 
 +please refer to the instructions in UPGRADING guide. 
 + 
 + 
 +OPTIMISING 
 +========== 
 + 
 +There are two forms of optimisation here, compression and caching, both aimed 
 +at increasing an end user's experience using Roundcube Webmail. Compression 
 +allows the static web pages to be delivered with less bandwidth. The index.php 
 +of Roundcube Webmail already enables compression on its output. The settings 
 +below allow compression to occur for all static files. Caching sets HTTP  
 +response headers that enable a user's web client to understand what is static 
 +and how to cache it. 
 + 
 +The caching directives used are: 
 + * Etags - sets at tag so the client can request is the page has changed 
 + * Cache-control - defines the age of the page and that the page is 'public' 
 +   This enables clients to cache javascript files that don't have private  
 +   information between sessions even if using HTTPS. It also allows proxies 
 +   to share the same cached page between users. 
 + * Expires - provides another hint to increase the lifetime of static pages. 
 + 
 +For more information refer to RFC 2616. 
 + 
 +Side effects: 
 +------------- 
 +These directives are designed for production use. If you are using this in 
 +a development environment you may get horribly confused if your webclient 
 +is caching stuff that you changed on the server. Disabling the expires  
 +parts below should save you some grief. 
 + 
 +If you are changing the skins, it is recommended that you copy content to  
 +a different directory apart from 'default'
 + 
 +Apache: 
 +------- 
 +To enable these features in apache the following modules need to be enabled: 
 + * mod_deflate 
 + * mod_expires 
 + * mod_headers 
 + 
 +The optimisation is already included in the .htaccess file in the top  
 +directory of your installation. 
 + 
 +If you are using Apache version 2.2.9 and later, in the .htaccess file 
 +change the 'append' word to 'merge' for a more correct response. Keeping 
 +as 'append' shouldn't cause any problems though changing to merge will  
 +eliminate the possibility of duplicate 'public' headers in Cache-control. 
 + 
 +Lighttpd: 
 +--------- 
 +With Lightty the addition of Expire: tags by mod_expire is incompatible with 
 +the addition of "Cache-control: public". Using Cache-control 'public' is  
 +used below as it is assumed to give a better caching result. 
 + 
 +Enable modules in server.modules: 
 +    "mod_setenv" 
 +    "mod_compress" 
 + 
 +Mod_compress is a server side cache of compressed files to improve its performance. 
 + 
 +$HTTP["host"] == "www.example.com"
 + 
 +    static-file.etags = "enable" 
 +    # http://redmine.lighttpd.net/projects/lighttpd/wiki/Etag.use-mtimeDetails 
 +    etag.use-mtime = "enable" 
 + 
 +    # http://redmine.lighttpd.net/projects/lighttpd/wiki/Docs:ModSetEnv 
 +    $HTTP["url"] =~ "^/roundcubemail/(plugins|skins|program)"
 +        setenv.add-response-header  = ( "Cache-Control" => "public, max-age=2592000"
 +    } 
 + 
 +    # http://redmine.lighttpd.net/projects/lighttpd/wiki/Docs:ModCompress 
 +    # set compress.cache-dir to somewhere outside the docroot. 
 +    compress.cache-dir   = var.statedir + "/cache/compress" 
 + 
 +    compress.filetype = ("text/plain", "text/html", "text/javascript", "text/css", "text/xml", "image/gif", "image/png"
 +
 + 
 + 
 +KNOWN ISSUES 
 +============ 
 + 
 +Installations with uw-imap server should set imap_disabled_caps = array('ESEARCH'
 +in main configuration file. ESEARCH implementation in this server is broken (#1489184). 
 +</file> 
 + 
 +===== Konfiguration ===== 
 +==== Apachekonfig aus dem RPM ==== 
 +Da wir einen eigenen vHOST für den WEB-Mailer anbieten wollen und keine Unterverzeichniss-Konfiguration, kommentieren wir den Inhalt der Apache-Konfigurationsdatei //**/etc/httpd/conf.d/roundcubemail.conf**// aus. 
 +   # vim /etc/httpd/conf.d/roundcubemail.conf 
 + 
 +<file apache /etc/httpd/conf.d/roundcubemail.conf>## 
 +## Round Cube Webmail is a browser-based multilingual IMAP client 
 +## 
 +
 +#Alias /roundcubemail /usr/share/roundcubemail 
 +
 +## Define who can access the Webmail 
 +## You can enlarge permissions once configured 
 +
 +#<Directory /usr/share/roundcubemail/> 
 +#    <IfModule mod_authz_core.c> 
 +#        # Apache 2.4 
 +#        Require local 
 +#    </IfModule> 
 +#    <IfModule !mod_authz_core.c> 
 +#        # Apache 2.2 
 +#        Order Deny,Allow 
 +#        Deny from all 
 +#        Allow from 127.0.0.1 
 +#        Allow from ::1 
 +#    </IfModule> 
 +#</Directory> 
 +
 +## Define who can access the installer 
 +## keep this secured once configured 
 +
 +#<Directory /usr/share/roundcubemail/installer/> 
 +#    <IfModule mod_authz_core.c> 
 +#        # Apache 2.4 
 +#        Require local 
 +#    </IfModule> 
 +#    <IfModule !mod_authz_core.c> 
 +#        # Apache 2.2 
 +#        Order Deny,Allow 
 +#        Deny from all 
 +#        Allow from 127.0.0.1 
 +#        Allow from ::1 
 +#    </IfModule> 
 +#</Directory> 
 +
 +## Those directories should not be viewed by Web clients. 
 +#<Directory /usr/share/roundcubemail/bin/> 
 +#    Order Allow,Deny 
 +#    Deny from all 
 +#</Directory> 
 +#<Directory /usr/share/roundcubemail/plugins/enigma/home/> 
 +#    Order Allow,Deny 
 +#    Deny from all 
 +#</Directory> 
 +</file> 
 + 
 + 
 +==== Apache vHost ==== 
 +Für unsere Webmailer richten wir uns nun einen geeigneten vHost ein. Im Konfigurationsverzeichnis unseres [[centos:web_c7:apache_1|Apache-Webservers]] legen wir uns eine neue vHOST-Konfigurationsdatei an. 
 +   # vim /etc/httpd/conf.d/vhost_443_roundcubemail.conf 
 +<file apache /etc/httpd/conf.d/vhost_443_roundcubemail.conf># 
 +# roundcubemail.sec-mail.guru 
 +
 +<VirtualHost *:80> 
 +        ServerAdmin webmaster@nausch.org 
 +        ServerName roundcubemail.sec-mail.guru 
 +        ServerPath / 
 + 
 +        <Location /> 
 +                Options -Indexes +FollowSymLinks 
 +                Require all granted 
 +        </Location> 
 + 
 +        RewriteEngine on 
 +        RewriteCond %{HTTPS} off 
 +        RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} 
 + 
 +        DirectoryIndex index.php 
 + 
 +        ErrorLog logs/roundcubemail_error.log 
 +        CustomLog logs/roundcubemail_access.log combined 
 +</VirtualHost> 
 +<VirtualHost *:443> 
 +        ServerAdmin webmaster@nausch.org 
 +        ServerName roundcubemail.sec-mail.guru 
 +        ServerPath / 
 +        DocumentRoot "/usr/share/roundcubemail" 
 + 
 +        # Django 
 +        # Required, because there is a host with same ServerName and 
 +        # ServerAlias LISTENING ON PORT 80, - and if these lines are 
 +        # not present, and .htaccess-Files or LDAP-Access is enabled 
 +        # for one or more Directory the host on PORT 443 and PORT 80 
 +        # will ASK for .htaccess ord LDAP-Access, so please remember 
 +        # ---------------------------------------------------------- 
 +        # -- DO NOT DELETE THE FOLLOWING LINES, STARTING WITH SSL -- 
 +        # --         WHEN USING .htaccess or LDAP-Access!         -- 
 +        # ---------------------------------------------------------- 
 +        SSLEngine on 
 +        SSLProtocol -ALL +SSLv3 +TLSv1 
 +        SSLCipherSuite EECDH+AES256:DHE+AES256:EECDH+AES:EDH+AES:-SHA1:EECDH+RC4:EDH+RC4:RC4-SHA:AES256-SHA:!aNULL:!eNULL:!EXP:!LOW:!MD5 
 +        SSLHonorCipherOrder on 
 +        SSLCertificateFile /etc/pki/tls/private/CAcert-class3-wildcard.crt 
 +        SSLCertificateKeyFile /etc/pki/tls/private/ca.key 
 +        SSLCertificateChainFile /etc/pki/tls/private/CAcert_chain.crt 
 + 
 +        # Define who can access the Webmail 
 +        # You can enlarge permissions once configured 
 +        <Directory /usr/share/roundcubemail/> 
 +                <IfModule mod_authz_core.c> 
 +                # before configuration 
 +                Require local 
 +                # after configuration 
 +                # Require all granted 
 +                </IfModule> 
 +        </Directory> 
 + 
 +        # Define who can access the installer 
 +        # keep this secured once configured 
 +        <Directory /usr/share/roundcubemail/installer/> 
 +                <IfModule mod_authz_core.c> 
 +                # while configuration 
 +                Require host nausch.org 
 +                # after configuration 
 +                # Require local 
 +                </IfModule> 
 +        </Directory> 
 + 
 +        # Those directories should not be viewed by Web clients. 
 +        <Directory /usr/share/roundcubemail/bin/> 
 +                Require all denied 
 +        </Directory> 
 +        <Directory /usr/share/roundcubemail/plugins/enigma/home/> 
 +                Require all denied 
 +        </Directory> 
 + 
 +        DirectoryIndex index.php 
 +        ErrorLog logs/postfixadmin_error.log 
 +        CustomLog logs/postfixadmin_access.log combined 
 +</VirtualHost> 
 +</file> 
 + 
 +<WRAP round important>**Wichtig:** 
 + 
 +Solange wir unseren vHost noch nicht in der Produktionsumgebung steht und fertig konfiguriert wurde, beschränken wir den Zugriff auf den vHost noch. In der obigen Apache-vHOST ist dies bereits berücksichtigt! 
 + 
 +Erst nach erfolgter Konfiguration geben wir den vHOST für unsere Nutzer frei; hierzu tragen wir in der **Directive //Directory//** wie folgt ab: 
 +<code apache>... 
 + 
 +        # Define who can access the Webmail 
 +        # You can enlarge permissions once configured 
 + 
 +        <Directory /usr/share/roundcubemail/> 
 +                <IfModule mod_authz_core.c> 
 +                # before configuration 
 +                # Require local 
 +                # after configuration 
 +                Require all granted 
 +                </IfModule> 
 +        </Directory> 
 + 
 + 
 +        # Define who can access the installer 
 +        # keep this secured once configured 
 +        <Directory /usr/share/roundcubemail/installer/> 
 +                <IfModule mod_authz_core.c> 
 +                # while configuration 
 +                # Require host 10.0.0 
 +                # after configuration 
 +                Require local 
 +                </IfModule> 
 +        </Directory> 
 + 
 +... 
 +</code> 
 +</WRAP> 
 + 
 +Bevor unseren Webserver starten, damit der neue vHost auch bedient werden kann, überprüfen wir die Konfiguration noch auf syntaktische Fehler.  
 +   # apachectl -t 
 + 
 +Ist alles O.K. dann steht einem Reload des Apache httpd nichts mehr im Wege. 
 +   # systemctl reload httpd.service 
 + 
 +Wollen wir den Reload kontrollieren, fragen wir den Status des Webservers ab. 
 +   # systemctl status httpd.service 
 + 
 +<code>httpd.service - The Apache HTTP Server 
 +   Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled) 
 +   Active: active (running) since Tue 2014-09-09 18:26:47 CEST; 3h 48min ago 
 +  Process: 20019 ExecStop=/bin/kill -WINCH ${MAINPID} (code=exited, status=0/SUCCESS) 
 +  Process: 20368 ExecReload=/usr/sbin/httpd $OPTIONS -k graceful (code=exited, status=0/SUCCESS) 
 + Main PID: 20024 (httpd) 
 +   Status: "Total requests: 0; Current requests/sec: 0; Current traffic:   0 B/sec" 
 +   CGroup: /system.slice/httpd.service 
 +           ├─20024 /usr/sbin/httpd -DFOREGROUND 
 +           ├─20372 /usr/sbin/httpd -DFOREGROUND 
 +           ├─20373 /usr/sbin/httpd -DFOREGROUND 
 +           ├─20374 /usr/sbin/httpd -DFOREGROUND 
 +           ├─20375 /usr/sbin/httpd -DFOREGROUND 
 +           └─20376 /usr/sbin/httpd -DFOREGROUND 
 + 
 +Sep 09 22:15:07 vml000097.dmz.nausch.org systemd[1]: Reloading The Apache HTTP Server. 
 +Sep 09 22:15:07 vml000097.dmz.nausch.org systemd[1]: Reloaded The Apache HTTP Server. 
 +</code> 
 + 
 + 
 +==== mySQL Datenbank ==== 
 +Ein Großteil der Benutzer-Konfigurationsdaten werden in einer **[[centos:mysql|mySQL-Datenbank]]** /* FIXME */gespeichert und vorgehalten.  
 + 
 +=== Datenbank anlegen === 
 +Diese [[centos:mysql|mySQL-Datenbank]] und der zugehörige Datenbankuser werden wird nun im ersten Schritt anlegen. 
 + 
 +Wir melden uns also als berechtigter Datenbankuser an der mySQL-Datenbank an. 
 +    # mysql -h mysql.dmz.nausch.org -u root -p 
 + 
 +<code>Enter password:  
 +Welcome to the MySQL monitor.  Commands end with ; or \g. 
 +Your MySQL connection id is 188332 
 +Server version: 5.1.73 Source distribution 
 + 
 +Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved. 
 + 
 +Oracle is a registered trademark of Oracle Corporation and/or its 
 +affiliates. Other names may be trademarks of their respective 
 +owners. 
 + 
 +Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. 
 + 
 +mysql> 
 +</code> 
 + 
 +Dort legen wir als aller erst einmal eine Datenbank mit dem Namen **roundcubemail** an. 
 +   mysql> create database roundcubemail; 
 + 
 +   Query OK, 1 row affected (0.04 sec) 
 + 
 +=== Datenuserbank anlegen === 
 +Anschließend legen wir uns einen Datenbankuser an, denen wir entsprechende Rechte an der, gerade angelegten Datenbank **horde** einräumen. Als Namen nehme wir einfach **hode_admin_user**. 
 + 
 +   mysql> CREATE USER 'roundcube_user'@'10.0.0.97' IDENTIFIED BY 'n491o5rbgsDK67DeM9sCHfzd'; 
 + 
 +   Query OK, 0 rows affected (0.00 sec) 
 + 
 +und 
 +   mysql> CREATE USER 'roundcube_user'@'vml000097.dmz.nausch.org' IDENTIFIED BY 'n491o5rbgsDKMS67DeM9sCHfzd'; 
 + 
 +   Query OK, 0 rows affected (0.00 sec) 
 + 
 +=== Nutzerberechtigungen setzen === 
 +Dem gerade angelegten Datenbankuser für **[[http://roundcube.net|Roundcube]]** gewähren wir nun die nötigen Rechte, damit dieser vom Webserver aus, Tabellen anlegen, befüllen und verändern darf. 
 +   mysql> GRANT ALL PRIVILEGES ON roundcubemail.* TO 'roundcube_user'@'10.0.0.97' IDENTIFIED BY 'n491o5rbgsDKMS67DeM9sCHfzd' WITH GRANT OPTION MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0; 
 + 
 +   Query OK, 0 rows affected (0.00 sec) 
 + 
 +und 
 +   mysql> GRANT ALL PRIVILEGES ON roundcubemail.* TO 'roundcube_user'@'vml000097.dmz.nausch.org' IDENTIFIED BY 'n491o5rbgsDKMS67DeM9sCHfzd' WITH GRANT OPTION MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0; 
 + 
 +   Query OK, 0 rows affected (0.00 sec)  
 + 
 +=== Nutzerberechtigungen zuweisen === 
 +Zum Ende unserer mySQL-Userkonfiguration weisen wir unserem Nutzer die Berechtigungen zu. 
 +   mysql> FLUSH PRIVILEGES; 
 + 
 +   Query OK, 0 rows affected (0.00 sec) 
 + 
 +=== Zugriff testen === 
 +Als nächstes überprüfen wir, ob der zuvor angelegt User/Zugang auch funktioniert.  
 +   # mysql -D roundcubemail -h mysql.dmz.nausch.org -u roundcube_user -p 
 + 
 +<code>Enter password:  
 +Welcome to the MariaDB monitor.  Commands end with ; or \g. 
 +Your MySQL connection id is 188556 
 +Server version: 5.1.73 Source distribution 
 + 
 +Copyright (c) 2000, 2014, Oracle, Monty Program Ab and others. 
 + 
 +Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. 
 + 
 +MySQL [roundcubemail]> 
 +<code> 
 +<code>MySQL [roundcubemail]> show databases; 
 ++--------------------+ 
 +| Database           | 
 ++--------------------+ 
 +| information_schema | 
 +| roundcubemail      | 
 ++--------------------+ 
 +2 rows in set (0.00 sec) 
 + 
 +MySQL [roundcubemail]> 
 +</code> 
 +Da der Test positiv ausgefallen ist, können wie uns wieder von unserem Datenbankserver abmelden. 
 +  MySQL [roundcubemail]> quit 
 + 
 +  Bye 
 + 
 +==== Datenbanktabellen anlegen ==== 
 + 
 +Die von Roundcube benötigten Datebank-Tabellen, erstellen wir mit folgendem Aufruf. 
 +   # mysql -D roundcubemail -h mysql.dmz.nausch.org -u roundcube_user -p < /usr/share/roundcubemail/SQL/mysql.initial.sql  
 + 
 +   Enter password:  
 + 
 +==== PHP Date.Timezone ==== 
 +Damit der Installer später nicht beklagt, dass keine **date.timezone** gesetzt ist, kontrollieren wir noch kurz die Einstellungen in der Datei //**/etc/php.ini**//
 +   # vim /etc/php.ini 
 + 
 +<code php>... 
 + 
 +[Date] 
 +; Defines the default timezone used by the date functions 
 +; http://php.net/date.timezone 
 +; Django : 2014-09-09 
 +; default: ;date.timezone = 
 +date.timezone = "Europe/Berlin" 
 + 
 +; http://php.net/date.default-latitude 
 +;date.default_latitude = 31.7667 
 + 
 +; http://php.net/date.default-longitude 
 +;date.default_longitude = 35.2333 
 + 
 +; http://php.net/date.sunrise-zenith 
 +;date.sunrise_zenith = 90.583333 
 + 
 +; http://php.net/date.sunset-zenith 
 +;date.sunset_zenith = 90.583333 
 + 
 +... 
 +</code> 
 + 
 +Haben wir eine Änderung vorgenommen, veranlassen wir zur Aktivierung der Option einen Reload des http-Daemon. 
 +   # systemctl reload httpd.service 
 + 
 +==== Roundcube Konfiguration ==== 
 +Die Konfiguration von Roundcube erfolgt über die zentrale Konfigurationsdatei **config.inc.php** im Verzeichnis //**/etc/roundcubemail/**//
 + 
 +Die einfachste Variante diese Konfigurationsdatei zu erstellen ist über die WEB-GUI. Alternativ kann man natürlich auch die Datei direkt per Hand installieren. Werfen wir zu erst einmal einen Blick auf die Konfiguration mit Hilfe der WEB-GUI; hierzu rufen wir die **/installer**-URL auf. 
 +   $ firefox https://roundcubemail.sec-mail/installer/ 
 + 
 +{{ :centos:mail_c7:roundcubemail_01.png?direct&850 |Bild: Bildschirmhardcopy des Roundcube Installers (WEB-GUI) "Check environment"}} 
 + 
 +Auf der ersten Seite **//Check environment//** wird geprüft, ob die notwendigen Voraussetzungen gegeben sind. Wird ein Punkt beanstandet, kann man entsprechend eingreifen und den Fehler beheben. Passt alles, klickt man auf die Schaltfläche **[ NEXT ]** und man gelangt zum Schritt 2: **//Create config//**. 
 + 
 +{{ :centos:mail_c7:roundcubemail_02.png?direct&850 |Bild: Bildschirmhardcopy des Roundcube Installers (WEB-GUI) "Create config"}} 
 + 
 +Hat man alle Angaben für die Konfiguration unseres WEB-Mailers eingetragen, klicken wir auf die Schaltfläche **[ CREATE CONFIG ]** um die Konfigurationsdatei online zu erstellen. 
 + 
 +{{ :centos:mail_c7:roundcubemail_03.png?direct&850 |Bild: Bildschirmhardcopy des Roundcube Installers (WEB-GUI) "Create config"}} 
 + 
 +Hier haben wir zwei Möglichkeiten. Entweder wir kopieren den Text direkt aus dem Anzeigefenster und fügen den kopierten Text dann in die Datei //**/etc/roundcubemail/config.inc.php**// oder wir klicken auf die Schaltfläche **[ Download ]** und kopieren die Datei dann mit Hilfe von **scp** auf den Webserver. 
 + 
 +   # less /etc/roundcubemail/config.inc.php  
 +<file php /etc/roundcubemail/config.inc.php><?php                                                                                                                                                                             
 + 
 +/* Local configuration for Roundcube Webmail */ 
 + 
 +// ---------------------------------- 
 +// SQL DATABASE 
 +// ---------------------------------- 
 +// Database connection string (DSN) for read+write operations 
 +// Format (compatible with PEAR MDB2): db_provider://user:password@host/database 
 +// Currently supported db_providers: mysql, pgsql, sqlite, mssql or sqlsrv 
 +// For examples see http://pear.php.net/manual/en/package.database.mdb2.intro-dsn.php 
 +// NOTE: for SQLite use absolute path: 'sqlite:////full/path/to/sqlite.db?mode=0646' 
 +$config['db_dsnw'] = 'mysql://roundcube_user:n491o5rbgsDK67DeM9sCHfzd@mysql.dmz.nausch.org/roundcubemail'; 
 + 
 +// ---------------------------------- 
 +// IMAP 
 +// ---------------------------------- 
 +// The mail host chosen to perform the log-in. 
 +// Leave blank to show a textbox at login, give a list of hosts 
 +// to display a pulldown menu or set one host as string. 
 +// To use SSL/TLS connection, enter hostname with prefix ssl:// or tls:// 
 +// Supported replacement variables: 
 +// %n - hostname ($_SERVER['SERVER_NAME']) 
 +// %t - hostname without the first part 
 +// %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part) 
 +// %s - domain name after the '@' from e-mail address provided at login screen 
 +// For example %n = mail.domain.tld, %t = domain.tld 
 +// WARNING: After hostname change update of mail_host column in users table is 
 +//          required to match old user data records with the new host. 
 +$config['default_host'] = 'tls://imap.nausch.org'; 
 + 
 +// ---------------------------------- 
 +// SMTP 
 +// ---------------------------------- 
 +// SMTP server host (for sending mails). 
 +// To use SSL/TLS connection, enter hostname with prefix ssl:// or tls:// 
 +// If left blank, the PHP mail() function is used 
 +// Supported replacement variables: 
 +// %h - user's IMAP hostname 
 +// %n - hostname ($_SERVER['SERVER_NAME']) 
 +// %t - hostname without the first part 
 +// %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part) 
 +// %z - IMAP domain (IMAP hostname without the first part) 
 +// For example %n = mail.domain.tld, %t = domain.tld 
 +$config['smtp_server'] = 'smtp.dmz.nausch.org'; 
 + 
 +// provide an URL where a user can get support for this Roundcube installation 
 +// PLEASE DO NOT LINK TO THE ROUNDCUBE.NET WEBSITE HERE! 
 +$config['support_url'] = 'https://dokuwiki.nausch.org/doku.php/centos:mail_c7:start'; 
 + 
 +// automatically create a new Roundcube user when log-in the first time. 
 +// a new user will be created once the IMAP login succeeds. 
 +// set to false if only registered users can use this service 
 +$config['auto_create_user'] = true; 
 + 
 +// this key is used to encrypt the users imap password which is stored 
 +// in the session record (and the client cookie if remember password is enabled). 
 +// please provide a string of exactly 24 chars. 
 +$config['des_key'] = 'x5-Lx+B!1i?EElMdyPUE4t_6'; 
 + 
 +// ---------------------------------- 
 +// PLUGINS 
 +// ---------------------------------- 
 +// List of active plugins (in plugins/ directory) 
 +$config['plugins'] = array( ); 
 + 
 +// the default locale setting (leave empty for auto-detection) 
 +// RFC1766 formatted language name like en_US, de_DE, de_CH, fr_FR, pt_BR 
 +$config['language'] = 'de_DE'; 
 + 
 +// store spam messages in this mailbox 
 +// NOTE: Use folder names with namespace prefix (INBOX. on Courier-IMAP) 
 +$config['junk_mbox'] = ''; 
 + 
 +// display these folders separately in the mailbox list. 
 +// these folders will also be displayed with localized names 
 +// NOTE: Use folder names with namespace prefix (INBOX. on Courier-IMAP) 
 +$config['default_folders'] = array('INBOX', 'Drafts', 'Sent', '', 'Trash'); 
 + 
 +// Set the spell checking engine. Possible values: 
 +// - 'googie'  - the default 
 +// - 'pspell'  - requires the PHP Pspell module and aspell installed 
 +// - 'enchant' - requires the PHP Enchant module 
 +// - 'atd'     - install your own After the Deadline server or check with the people at http://www.afterthedeadline.com before using their API 
 +// Since Google shut down their public spell checking service, you need to  
 +// connect to a Nox Spell Server when using 'googie' here. Therefore specify the 'spellcheck_uri' 
 +$config['spellcheck_engine'] = 'pspell'; 
 + 
 +// prefer displaying HTML messages 
 +$config['prefer_html'] = false; 
 + 
 +// Encoding of long/non-ascii attachment names: 
 +// 0 - Full RFC 2231 compatible 
 +// 1 - RFC 2047 for 'name' and RFC 2231 for 'filename' parameter (Thunderbird's default) 
 +// 2 - Full 2047 compatible 
 +$config['mime_param_folding'] = 0; 
 + 
 + 
 +</file> 
 + 
 +Anschließend passen wir noch die Dateirechte der konfigurationsdatei an. 
 +   # chmod 640 /etc/roundcubemail/config.inc.php 
 + 
 +   # chown root.apache /etc/roundcubemail/config.inc.php 
 + 
 +Nun können wir auf der WEB-GUI die Schaltfläche **[ CONTINUE ]** anklicken um zum dritten Schritt //**Test config**// zu gelangen. 
 + 
 + 
 +{{ :centos:mail_c7:roundcubemail_04.png?direct&850 |Bild: Bildschirmhardcopy des Roundcube Installers (WEB-GUI) "Test config"}} 
 + 
 +Sind alle Tests bestanden, können wir den **installer** deaktivieren und die Anwendung für den abschließenden Test "Anmeldung als User an unserem neunen Webmailer. 
 + 
 +<WRAP round tip> 
 +Wir ändern nun die **Directive //Directory//** in der Konfigurationsdatei //**/etc/httpd/conf.d/vhost_443_roundcubemail.conf**// die entsprechenden Einträge ab. 
 +<code> # vim /etc/httpd/conf.d/vhost_443_roundcubemail.conf</code> <code apache>... 
 + 
 +        # Define who can access the Webmail 
 +        # You can enlarge permissions once configured 
 + 
 +        <Directory /usr/share/roundcubemail/> 
 +                <IfModule mod_authz_core.c> 
 +                # before configuration 
 +                # Require local 
 +                # after configuration 
 +                Require all granted 
 +                </IfModule> 
 +        </Directory> 
 + 
 + 
 +        # Define who can access the installer 
 +        # keep this secured once configured 
 +        <Directory /usr/share/roundcubemail/installer/> 
 +                <IfModule mod_authz_core.c> 
 +                # while configuration 
 +                # Require host 10.0.0 
 +                # after configuration 
 +                Require local 
 +                </IfModule> 
 +        </Directory> 
 + 
 +... 
 +</code> Anschließend führen wir einen Reload des HTTP-Daemon durch, damit die Änderung der Zugriffsrechte aktiv wird. <code> # systemctl reload httpd.service</code> 
 +</WRAP> 
 + 
 +Ob die Sperrung des **installer** passt, kontrollieren wir einfach durch einen erneuten Aufruf der betreffenden URL. 
 +   $ firefox https://roundcubemail.sec-mail/installer/ 
 + 
 +{{ :centos:mail_c7:roundcubemail_05.png?direct&700 |Bild: Bildschirmhardcopy des gesperrten Roundcube Installers (WEB-GUI)}} 
 + 
 +Test eins ist schon mal bestanden, wir rufen also als nächstes die URL unseres Webmailers auf. 
 +   $ firefox https://roundcubemail.sec-mail 
 + 
 +{{ :centos:mail_c7:roundcubemail_06.png?direct&850 |Bild: Bildschirmhardcopy der Loginmaske des Roundcube Webmailers}} 
 + 
 +Wir erreichen die Anmeldemaske und nun steht nur noch der Test an, ob wir uns auch anmelden können. 
 + 
 + 
 +{{ :centos:mail_c7:roundcubemail_07.png?direct&850 |Bild: Bildschirmhardcopy des Roundcube Webmailers (bei erfolgreichem Login)}} 
 + 
 +===== Plugins ===== 
 +Mit Hilfe von Plugins kann Roundcube um verschiedene Funktionen und Fähigkeiten erweitert werden. Bei der Installation des RPM wurden bereits alle Plugins in das Verzeichnis //**/usr/share/roundcubemail/plugins/**// kopiert. Einen Überblick verschaffen wir uns mit einem Blick in das betreffende Verzeichnis. 
 +   # /usr/share/roundcubemail/plugins/ 
 + 
 +<code>/usr/share/roundcubemail/plugins/ 
 +├── acl 
 +├── additional_message_headers 
 +├── archive 
 +├── attachment_reminder 
 +├── autologon 
 +├── database_attachments 
 +├── debug_logger 
 +├── emoticons 
 +├── enigma 
 +├── example_addressbook 
 +├── filesystem_attachments 
 +├── help 
 +├── hide_blockquote 
 +├── http_authentication 
 +├── identity_select 
 +├── jqueryui 
 +├── managesieve 
 +├── markasjunk 
 +├── newmail_notifier 
 +├── new_user_dialog 
 +├── new_user_identity 
 +├── password 
 +├── redundant_attachments 
 +├── show_additional_headers 
 +├── squirrelmail_usercopy 
 +├── subscriptions_option 
 +├── userinfo 
 +├── vcard_attachments 
 +├── virtuser_file 
 +├── virtuser_query 
 +└── zipdownload 
 +</code> 
 + 
 +In unserem konfigurationsbeispiel beschränken wir uns dabei auf die drei wichtigsten Plugins, nämlich **Password** und **Managesieve** und **ACL**. Hierzu tragen wir die drei Plugins bei der Konfigurations-Array **plugins** ein. 
 + 
 +   # vim /etc/roundcubemail/config.inc.php 
 +<code php>... 
 + 
 +// ---------------------------------- 
 +// PLUGINS 
 +// ---------------------------------- 
 +// List of active plugins (in plugins/ directory) 
 +$config['plugins'] = array('acl','managesieve','password'); 
 + 
 +... 
 +</code> 
 +==== Password ==== 
 +Damit unsere User später Ihr **[[centos:mail_c7:dovecot_6|Passwort]]** eigenständig ändern können, konfigurieren wir nun das zugehörige Plugin **password**. 
 +Als erstes kopieren wir die Vorgabedatei, die im RPM-Paket enthalten ist. 
 +   # cp -a /usr/share/roundcubemail/plugins/password/config.inc.php.dist /usr/share/roundcubemail/plugins/password/config.inc.php 
 + 
 +Anschließend bearbeiten wir diese Datei und tragen dort die Datenbankanbindung zur MySQL sowie das benötigte SQL-Statement ein. In dem nachfolgenden Beispiel sind die nötigen Änderungen mit //**Django**// und //**Datum**// gekennzeichnet. 
 +   # vim /usr/share/roundcubemail/plugins/password/config.inc.php 
 +<file php /usr/share/roundcubemail/plugins/password/config.inc.php><?php 
 + 
 +// Password Plugin options 
 +// ----------------------- 
 +// A driver to use for password change. Default: "sql"
 +// See README file for list of supported driver names. 
 +$config['password_driver'] = 'sql'; 
 + 
 +// Determine whether current password is required to change password. 
 +// Default: false. 
 +$config['password_confirm_current'] = true; 
 + 
 +// Require the new password to be a certain length. 
 +// set to blank to allow passwords of any length 
 +// Django : 2014-09-10 
 +// default: $config['password_minimum_length'] = 0; 
 +$config['password_minimum_length'] = 8; 
 + 
 +// Require the new password to contain a letter and punctuation character 
 +// Change to false to remove this check. 
 +// Django : 2014-09-10 
 +// default: $config['password_require_nonalpha'] = false; 
 +$config['password_require_nonalpha'] = true; 
 + 
 +// Enables logging of password changes into logs/password 
 +$config['password_log'] = false; 
 + 
 +// Comma-separated list of login exceptions for which password change 
 +// will be not available (no Password tab in Settings) 
 +$config['password_login_exceptions'] = null; 
 + 
 +// Array of hosts that support password changing. Default is NULL. 
 +// Listed hosts will feature a Password option in Settings; others will not. 
 +// Example: 
 +//$config['password_hosts'] = array('mail.example.com', 'mail2.example.org'); 
 +$config['password_hosts'] = null; 
 + 
 +// Enables saving the new password even if it matches the old password. Useful 
 +// for upgrading the stored passwords after the encryption scheme has changed. 
 +$config['password_force_save'] = false; 
 + 
 + 
 +// SQL Driver options 
 +// ------------------ 
 +// PEAR database DSN for performing the query. By default 
 +// Roundcube DB settings are used. 
 +// Django : 2014-09-10 
 +// default: $config['password_db_dsn'] = ''; 
 +$config['password_db_dsn'] = 'mysql://pfadmin_user:rbgsDK39DeM2b2btx9iMHfzd@mysql.dmz.nausch.org/postfix'; 
 + 
 +// The SQL query used to change the password. 
 +// The query can contain the following macros that will be expanded as follows: 
 +//      %p is replaced with the plaintext new password 
 +//      %c is replaced with the crypt version of the new password, MD5 if available 
 +//         otherwise DES. More hash function can be enabled using the password_crypt_hash  
 +//         configuration parameter. 
 +//      %D is replaced with the dovecotpw-crypted version of the new password 
 +//      %o is replaced with the password before the change 
 +//      %n is replaced with the hashed version of the new password 
 +//      %q is replaced with the hashed password before the change 
 +//      %h is replaced with the imap host (from the session info) 
 +//      %u is replaced with the username (from the session info) 
 +//      %l is replaced with the local part of the username 
 +//         (in case the username is an email address) 
 +//      %d is replaced with the domain part of the username 
 +//         (in case the username is an email address) 
 +// Escaping of macros is handled by this module. 
 +// Default: "SELECT update_passwd(%c, %u)" 
 +// Django : 2014-09-10 
 +// default: $config['password_query'] = 'SELECT update_passwd(%c, %u)'; 
 +$config['password_query'] = 'UPDATE mailbox SET password = %p, modified=NOW() WHERE username = %u LIMIT 1'; 
 + 
 +// By default the crypt() function which is used to create the '%c'  
 +// parameter uses the md5 algorithm. To use different algorithms  
 +// you can choose between: des, md5, blowfish, sha256, sha512. 
 +// Before using other hash functions than des or md5 please make sure 
 +// your operating system supports the other hash functions. 
 +$config['password_crypt_hash'] = 'md5'; 
 + 
 +// By default domains in variables are using unicode. 
 +// Enable this option to use punycoded names 
 +$config['password_idn_ascii'] = false; 
 + 
 +// Path for dovecotpw (if not in $PATH) 
 +// $config['password_dovecotpw'] = '/usr/local/sbin/dovecotpw'; 
 + 
 +// Dovecot method (dovecotpw -s 'method'
 +// Django : 2014-09-10 
 +// default: $config['password_dovecotpw_method'] = 'CRAM-MD5'; 
 +$config['password_dovecotpw_method'] = 'CRAM-MD5'; 
 + 
 +// Enables use of password with crypt method prefix in %D, e.g. {MD5}$1$LUiMYWqx$fEkg/ggr/L6Mb2X7be4i1/ 
 +$config['password_dovecotpw_with_method'] = false; 
 + 
 +// Using a password hash for %n and %q variables. 
 +// Determine which hashing algorithm should be used to generate 
 +// the hashed new and current password for using them within the 
 +// SQL query. Requires PHP's 'hash' extension. 
 +$config['password_hash_algorithm'] = 'sha1'; 
 + 
 +// You can also decide whether the hash should be provided 
 +// as hex string or in base64 encoded format. 
 +$config['password_hash_base64'] = false; 
 + 
 + 
 +// Poppassd Driver options 
 +// ----------------------- 
 +// The host which changes the password 
 +$config['password_pop_host'] = 'localhost'; 
 + 
 +// TCP port used for poppassd connections 
 +$config['password_pop_port'] = 106; 
 + 
 + 
 +// SASL Driver options 
 +// ------------------- 
 +// Additional arguments for the saslpasswd2 call 
 +$config['password_saslpasswd_args'] = ''; 
 + 
 + 
 +// LDAP and LDAP_SIMPLE Driver options 
 +// ----------------------------------- 
 +// LDAP server name to connect to.  
 +// You can provide one or several hosts in an array in which case the hosts are tried from left to right. 
 +// Exemple: array('ldap1.exemple.com', 'ldap2.exemple.com'); 
 +// Default: 'localhost' 
 +$config['password_ldap_host'] = 'localhost'; 
 + 
 +// LDAP server port to connect to 
 +// Default: '389' 
 +$config['password_ldap_port'] = '389'; 
 + 
 +// TLS is started after connecting 
 +// Using TLS for password modification is recommanded. 
 +// Default: false 
 +$config['password_ldap_starttls'] = false; 
 + 
 +// LDAP version 
 +// Default: '3' 
 +$config['password_ldap_version'] = '3'; 
 + 
 +// LDAP base name (root directory) 
 +// Exemple: 'dc=exemple,dc=com' 
 +$config['password_ldap_basedn'] = 'dc=exemple,dc=com'; 
 + 
 +// LDAP connection method 
 +// There is two connection method for changing a user's LDAP password. 
 +// 'user': use user credential (recommanded, require password_confirm_current=true) 
 +// 'admin': use admin credential (this mode require password_ldap_adminDN and password_ldap_adminPW) 
 +// Default: 'user' 
 +$config['password_ldap_method'] = 'user'; 
 + 
 +// LDAP Admin DN 
 +// Used only in admin connection mode 
 +// Default: null 
 +$config['password_ldap_adminDN'] = null; 
 + 
 +// LDAP Admin Password 
 +// Used only in admin connection mode 
 +// Default: null 
 +$config['password_ldap_adminPW'] = null; 
 + 
 +// LDAP user DN mask 
 +// The user's DN is mandatory and as we only have his login, 
 +// we need to re-create his DN using a mask 
 +// '%login' will be replaced by the current roundcube user's login 
 +// '%name' will be replaced by the current roundcube user's name part 
 +// '%domain' will be replaced by the current roundcube user's domain part 
 +// '%dc' will be replaced by domain name hierarchal string e.g. "dc=test,dc=domain,dc=com" 
 +// Exemple: 'uid=%login,ou=people,dc=exemple,dc=com' 
 +$config['password_ldap_userDN_mask'] = 'uid=%login,ou=people,dc=exemple,dc=com'; 
 + 
 +// LDAP search DN 
 +// The DN roundcube should bind with to find out user's DN 
 +// based on his login. Note that you should comment out the default 
 +// password_ldap_userDN_mask setting for this to take effect. 
 +// Use this if you cannot specify a general template for user DN with 
 +// password_ldap_userDN_mask. You need to perform a search based on 
 +// users login to find his DN instead. A common reason might be that 
 +// your users are placed under different ou's like engineering or 
 +// sales which cannot be derived from their login only. 
 +$config['password_ldap_searchDN'] = 'cn=roundcube,ou=services,dc=example,dc=com'; 
 + 
 +// LDAP search password 
 +// If password_ldap_searchDN is set, the password to use for 
 +// binding to search for user's DN. Note that you should comment out the default 
 +// password_ldap_userDN_mask setting for this to take effect. 
 +// Warning: Be sure to set approperiate permissions on this file so this password 
 +// is only accesible to roundcube and don't forget to restrict roundcube's access to 
 +// your directory as much as possible using ACLs. Should this password be compromised 
 +// you want to minimize the damage. 
 +$config['password_ldap_searchPW'] = 'secret'; 
 + 
 +// LDAP search base 
 +// If password_ldap_searchDN is set, the base to search in using the filter below. 
 +// Note that you should comment out the default password_ldap_userDN_mask setting 
 +// for this to take effect. 
 +$config['password_ldap_search_base'] = 'ou=people,dc=example,dc=com'; 
 + 
 +// LDAP search filter 
 +// If password_ldap_searchDN is set, the filter to use when 
 +// searching for user's DN. Note that you should comment out the default 
 +// password_ldap_userDN_mask setting for this to take effect. 
 +// '%login' will be replaced by the current roundcube user's login 
 +// '%name' will be replaced by the current roundcube user's name part 
 +// '%domain' will be replaced by the current roundcube user's domain part 
 +// '%dc' will be replaced by domain name hierarchal string e.g. "dc=test,dc=domain,dc=com" 
 +// Example: '(uid=%login)' 
 +// Example: '(&(objectClass=posixAccount)(uid=%login))' 
 +$config['password_ldap_search_filter'] = '(uid=%login)'; 
 + 
 +// LDAP password hash type 
 +// Standard LDAP encryption type which must be one of: crypt, 
 +// ext_des, md5crypt, blowfish, md5, sha, smd5, ssha, ad or clear. 
 +// Please note that most encodage types require external libraries 
 +// to be included in your PHP installation, see function hashPassword in drivers/ldap.php for more info. 
 +// Default: 'crypt' 
 +$config['password_ldap_encodage'] = 'crypt'; 
 + 
 +// LDAP password attribute 
 +// Name of the ldap's attribute used for storing user password 
 +// Default: 'userPassword' 
 +$config['password_ldap_pwattr'] = 'userPassword'; 
 + 
 +// LDAP password force replace 
 +// Force LDAP replace in cases where ACL allows only replace not read 
 +// See http://pear.php.net/package/Net_LDAP2/docs/latest/Net_LDAP2/Net_LDAP2_Entry.html#methodreplace 
 +// Default: true 
 +$config['password_ldap_force_replace'] = true; 
 + 
 +// LDAP Password Last Change Date 
 +// Some places use an attribute to store the date of the last password change 
 +// The date is meassured in "days since epoch" (an integer value) 
 +// Whenever the password is changed, the attribute will be updated if set (e.g. shadowLastChange) 
 +$config['password_ldap_lchattr'] = ''; 
 + 
 +// LDAP Samba password attribute, e.g. sambaNTPassword 
 +// Name of the LDAP's Samba attribute used for storing user password 
 +$config['password_ldap_samba_pwattr'] = ''; 
 +  
 +// LDAP Samba Password Last Change Date attribute, e.g. sambaPwdLastSet 
 +// Some places use an attribute to store the date of the last password change 
 +// The date is meassured in "seconds since epoch" (an integer value) 
 +// Whenever the password is changed, the attribute will be updated if set 
 +$config['password_ldap_samba_lchattr'] = ''; 
 + 
 + 
 +// DirectAdmin Driver options 
 +// -------------------------- 
 +// The host which changes the password 
 +// Use 'ssl://host' instead of 'tcp://host' when running DirectAdmin over SSL. 
 +// The host can contain the following macros that will be expanded as follows: 
 +//     %h is replaced with the imap host (from the session info) 
 +//     %d is replaced with the domain part of the username (if the username is an email) 
 +$config['password_directadmin_host'] = 'tcp://localhost'; 
 + 
 +// TCP port used for DirectAdmin connections 
 +$config['password_directadmin_port'] = 2222; 
 + 
 + 
 +// vpopmaild Driver options 
 +// ----------------------- 
 +// The host which changes the password 
 +$config['password_vpopmaild_host'] = 'localhost'; 
 + 
 +// TCP port used for vpopmaild connections 
 +$config['password_vpopmaild_port'] = 89; 
 + 
 + 
 +// cPanel Driver options 
 +// -------------------------- 
 +// The cPanel Host name 
 +$config['password_cpanel_host'] = 'host.domain.com'; 
 + 
 +// The cPanel admin username 
 +$config['password_cpanel_username'] = 'username'; 
 + 
 +// The cPanel admin password 
 +$config['password_cpanel_password'] = 'password'; 
 + 
 +// The cPanel port to use 
 +$config['password_cpanel_port'] = 2087; 
 + 
 + 
 +// XIMSS (Communigate server) Driver options 
 +// ----------------------------------------- 
 +// Host name of the Communigate server 
 +$config['password_ximss_host'] = 'mail.example.com'; 
 + 
 +// XIMSS port on Communigate server 
 +$config['password_ximss_port'] = 11024; 
 + 
 + 
 +// chpasswd Driver options 
 +// --------------------- 
 +// Command to use 
 +$config['password_chpasswd_cmd'] = 'sudo /usr/sbin/chpasswd 2> /dev/null'; 
 + 
 + 
 +// XMail Driver options 
 +// --------------------- 
 +$config['xmail_host'] = 'localhost'; 
 +$config['xmail_user'] = 'YourXmailControlUser'; 
 +$config['xmail_pass'] = 'YourXmailControlPass'; 
 +$config['xmail_port'] = 6017; 
 + 
 + 
 +// hMail Driver options 
 +// ----------------------- 
 +// Remote hMailServer configuration 
 +// true:  HMailserver is on a remote box (php.ini: com.allow_dcom = true) 
 +// false: Hmailserver is on same box as PHP 
 +$config['hmailserver_remote_dcom'] = false; 
 +// Windows credentials 
 +$config['hmailserver_server'] = array( 
 +    'Server' => 'localhost', // hostname or ip address 
 +    'Username' => 'administrator', // windows username 
 +    'Password' => 'password' // windows user password 
 +); 
 + 
 + 
 +// Virtualmin Driver options 
 +// ------------------------- 
 +// Username format: 
 +// 0: username@domain 
 +// 1: username%domain 
 +// 2: username.domain 
 +// 3: domain.username 
 +// 4: username-domain 
 +// 5: domain-username 
 +// 6: username_domain 
 +// 7: domain_username 
 +$config['password_virtualmin_format'] = 0; 
 + 
 + 
 +// pw_usermod Driver options 
 +// -------------------------- 
 +// Use comma delimited exlist to disable password change for users 
 +// Add the following line to visudo to tighten security: 
 +// www  ALL=NOPASSWORD: /usr/sbin/pw 
 +$config['password_pw_usermod_cmd'] = 'sudo /usr/sbin/pw usermod -h 0 -n'; 
 + 
 + 
 +// DBMail Driver options 
 +// ------------------- 
 +// Additional arguments for the dbmail-users call 
 +$config['password_dbmail_args'] = '-p sha512'; 
 + 
 + 
 +// Expect Driver options 
 +// --------------------- 
 +// Location of expect binary 
 +$config['password_expect_bin'] = '/usr/bin/expect'; 
 + 
 +// Location of expect script (see helpers/passwd-expect) 
 +$config['password_expect_script'] = ''; 
 + 
 +// Arguments for the expect script. See the helpers/passwd-expect file for details. 
 +// This is probably a good starting default: 
 +//   -telent -host localhost -output /tmp/passwd.log -log /tmp/passwd.log 
 +$config['password_expect_params'] = ''; 
 + 
 + 
 +// smb Driver options 
 +// --------------------- 
 +// Samba host (default: localhost) 
 +// Supported replacement variables: 
 +// %n - hostname ($_SERVER['SERVER_NAME']) 
 +// %t - hostname without the first part 
 +// %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part) 
 +$config['password_smb_host'] = 'localhost'; 
 +// Location of smbpasswd binary 
 +$config['password_smb_cmd'] = '/usr/bin/smbpasswd'; 
 +</file> 
 + 
 +Über den Menüpunkt **Einstellungen / Passwort** können wir nun vom Webmailer aus das Passwort ändern. 
 + 
 +{{ :centos:mail_c7:roundcubemail_08.png?direct&700 |Bild: Roundcube Webmailer - Dialog zum Ändern des Passwortes}}  
 + 
 + 
 +==== Managesieve ==== 
 +Damit unsere Mailkunden ihre **[[centos:mail_c7:dovecot_3|sieve-Regeln]]** direkt aus Roundcube heraus komfortabel ändern können, aktivieren wir das zugehörige Plugin **managesieve** 
 + 
 +Auch hier kopieren wir als erstes die Vorgabedatei aus dem RPM-Paket. 
 +   # cp /usr/share/roundcubemail/plugins/managesieve/config.inc.php.dist /usr/share/roundcubemail/plugins/managesieve/config.inc.php -a 
 + 
 +Anschließend bearbeiten wir diese Datei und tragen dort die benötigten sieve-Konfigurationsdetail ein. Auch hier sind in dem nachfolgenden Beispiel die Änderungen mit //**Django**// und //**Datum**// gekennzeichnet. 
 +   # vim /usr/share/roundcubemail/plugins/managesieve/config.inc.php 
 +<file php /usr/share/roundcubemail/plugins/managesieve/config.inc.php><?php 
 + 
 +// managesieve server port. When empty the port will be determined automatically 
 +// using getservbyname() function, with 4190 as a fallback. 
 +// Django : 2014-09-10 
 +// default: $config['managesieve_port'] = null; 
 +$config['managesieve_port'] = 4190; 
 + 
 +// managesieve server address, default is localhost. 
 +// Replacement variables supported in host name: 
 +// %h - user's IMAP hostname 
 +// %n - http hostname ($_SERVER['SERVER_NAME']) 
 +// %d - domain (http hostname without the first part) 
 +// For example %n = mail.domain.tld, %d = domain.tld 
 +// Django : 2014-09-10 
 +// default: $config['managesieve_host'] = 'localhost'; 
 +$config['managesieve_host'] = 'imap.dmz.nausch.org'; 
 + 
 +// authentication method. Can be CRAM-MD5, DIGEST-MD5, PLAIN, LOGIN, EXTERNAL 
 +// or none. Optional, defaults to best method supported by server. 
 +$config['managesieve_auth_type'] = null; 
 + 
 +// Optional managesieve authentication identifier to be used as authorization proxy. 
 +// Authenticate as a different user but act on behalf of the logged in user. 
 +// Works with PLAIN and DIGEST-MD5 auth. 
 +$config['managesieve_auth_cid'] = null; 
 + 
 +// Optional managesieve authentication password to be used for imap_auth_cid 
 +$config['managesieve_auth_pw'] = null; 
 + 
 +// use or not TLS for managesieve server connection 
 +// Note: tls:// prefix in managesieve_host is also supported 
 +// Django : 2014-09-10 
 +// default: $config['managesieve_usetls'] = false; 
 +$config['managesieve_usetls'] = true; 
 + 
 +// default contents of filters script (eg. default spam filter) 
 +$config['managesieve_default'] = '/etc/dovecot/sieve/global'; 
 + 
 +// The name of the script which will be used when there's no user script 
 +$config['managesieve_script_name'] = 'managesieve'; 
 + 
 +// Sieve RFC says that we should use UTF-8 endcoding for mailbox names, 
 +// but some implementations does not covert UTF-8 to modified UTF-7. 
 +// Defaults to UTF7-IMAP 
 +$config['managesieve_mbox_encoding'] = 'UTF-8'; 
 + 
 +// I need this because my dovecot (with listescape plugin) uses 
 +// ':' delimiter, but creates folders with dot delimiter 
 +$config['managesieve_replace_delimiter'] = ''; 
 + 
 +// disabled sieve extensions (body, copy, date, editheader, encoded-character, 
 +// envelope, environment, ereject, fileinto, ihave, imap4flags, index, 
 +// mailbox, mboxmetadata, regex, reject, relational, servermetadata, 
 +// spamtest, spamtestplus, subaddress, vacation, variables, virustest, etc. 
 +// Note: not all extensions are implemented 
 +$config['managesieve_disabled_extensions'] = array(); 
 + 
 +// Enables debugging of conversation with sieve server. Logs it into <log_dir>/sieve 
 +$config['managesieve_debug'] = false; 
 + 
 +// Enables features described in http://wiki.kolab.org/KEP:14 
 +$config['managesieve_kolab_master'] = false; 
 + 
 +// Script name extension used for scripts including. Dovecot uses '.sieve', 
 +// Cyrus uses '.siv'. Doesn't matter if you have managesieve_kolab_master disabled. 
 +$config['managesieve_filename_extension'] = '.sieve'; 
 + 
 +// List of reserved script names (without extension). 
 +// Scripts listed here will be not presented to the user. 
 +$config['managesieve_filename_exceptions'] = array(); 
 + 
 +// List of domains limiting destination emails in redirect action 
 +// If not empty, user will need to select domain from a list 
 +$config['managesieve_domains'] = array(); 
 + 
 +// Enables separate management interface for vacation responses (out-of-office) 
 +// 0 - no separate section (default), 
 +// 1 - add Vacation section, 
 +// 2 - add Vacation section, but hide Filters section 
 +$config['managesieve_vacation'] = 0; 
 + 
 +// Supported methods of notify extension. Default: 'mailto' 
 +$config['managesieve_notify_methods'] = array('mailto'); 
 +</file> 
 + 
 +Über den Menüpunkt **Einstellungen / Filter** können wir nun vom Webmailer aus das Passwort ändern. 
 + 
 +{{ :centos:mail_c7:roundcubemail_09.png?direct&850 |Bild: Roundcube Webmailer - Dialog zum Verwalter der sieve-Regeln}}  
 + 
 + 
 +==== ACL ==== 
 +Für die Verwaltung von **[[centos:mail_c7:dovecot_7|Shared Foldern]]** konfigurieren wir nun noch das **ACL**-Plugin. 
 +Als erstes kopieren wir die Konfigurationsdatei aus dem RPM. 
 +   # cp /usr/share/roundcubemail/plugins/acl/config.inc.php.dist /usr/share/roundcubemail/plugins/acl/config.inc.php -a 
 + 
 +Anschließend bearbeiten wir nun diese neue Datei. 
 +   # vim /usr/share/roundcubemail/plugins/acl/config.inc.php 
 +<file php /usr/share/roundcubemail/plugins/acl/config.inc.php><?php 
 + 
 +// Default look of access rights table 
 +// In advanced mode all access rights are displayed separately 
 +// In simple mode access rights are grouped into four groups: read, write, delete, full  
 +$config['acl_advanced_mode'] = false; 
 + 
 +// LDAP addressbook that would be searched for user names autocomplete. 
 +// That should be an array refering to the $config['ldap_public'] array key 
 +// or complete addressbook configuration array. 
 +$config['acl_users_source'] = ''; 
 + 
 +// The LDAP attribute which will be used as ACL user identifier 
 +$config['acl_users_field'] = 'mail'; 
 + 
 +// The LDAP search filter will be &'d with search queries 
 +$config['acl_users_filter'] = ''; 
 + 
 +// Include the following 'special' access control subjects in the ACL dialog; 
 +// Defaults to array('anyone', 'anonymous') (not when set to an empty array) 
 +// Example: array('anyone') to exclude 'anonymous'
 +// Set to an empty array to exclude all special aci subjects. 
 +$config['acl_specials'] = array('anyone', 'anonymous'); 
 + 
 +?> 
 +</file> 
 + 
 +Über den Menüpunkt **Einstellungen / Ordner / Ordnereigenschaften / Freigabe** können wir nun vom Webmailer aus die Zugriffsrechte für andere auf einzelne Ordner verwalten. 
 + 
 +{{ :centos:mail_c7:roundcubemail_10.png?direct&850 |Bild: Roundcube Webmailer - Dialog zum Verwalten von ACLs für Shared Folders}}  
 + 
 +====== Links ====== 
 +  * **[[centos:mail_c7:start|Zurück zum Kapitel >>Mailserverinstallation unter CentOS 7<<]]** 
 +  * **[[wiki:start|Zurück zu >>Projekte und Themenkapitel<<]]** 
 +  * **[[http://dokuwiki.nausch.org/doku.php/|Zurück zur Startseite]]** 
 + 
  • centos/mail_c7/roundcube_1.1410286102.txt.gz
  • Zuletzt geändert: 09.09.2014 18:08.
  • von django