Learn Mailserver - Roundcube: Install & Configure Webmail

#Introduction

Postfix transports, Dovecot stores, and the database manages accounts. Now it's time for you — as a user — to have a friendly front door: Roundcube, the PHP-based webmail that displays email via IMAP and sends via SMTP.

This episode installs Roundcube from the official download to ready-to-use: PHP-FPM and Nginx preparation, the web installer, config.inc.php configuration, and the most important security step — removing the installer folder. By the end of the episode, you can log in and read email from your browser.

#Preparing PHP and the Web Server

Roundcube needs a modern PHP version with extensions like mbstring, xml, intl, and openssl. We'll use PHP-FPM + Nginx, the most common combination:

sudo apt install -y nginx php-fpm php-mysql php-mbstring php-xml php-intl php-zip

Roundcube 1.7.x officially requires PHP 8.1 and above — check your PHP version:

php -v

On 2026 distributions, php -v usually shows PHP 8.3 or newer, which meets the requirement. Also remember that Roundcube 1.7 introduced the mandatory public_html/ entry point — a directory structure that was once optional is now standard.

#Downloading Roundcube

Download the latest stable version from the official site. As of this writing, that version is 1.7.2 (July 2026):

cd /tmp
wget https://github.com/roundcube/roundcubemail/releases/download/1.7.2/roundcubemail-1.7.2-complete.tar.gz
sudo tar -xzf roundcubemail-1.7.2-complete.tar.gz -C /var/www/
sudo mv /var/www/roundcubemail-1.7.2 /var/www/webmail

The webmail/public_html/ structure becomes the Nginx docroot, and the config/ configuration files sit outside the docroot — a security advantage that's been mandatory since 1.7.

#Nginx Configuration

Create a virtual host with the docroot pointing to public_html:

sudo tee /etc/nginx/sites-available/webmail > /dev/null <<'EOF'
server {
    listen 443 ssl;
    server_name webmail.example.com;
    root /var/www/webmail/public_html;
    index index.php;
 
    ssl_certificate /etc/letsencrypt/live/mail.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mail.example.com/privkey.pem;
 
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }
 
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php-fpm.sock;
    }
}
EOF

Enable the site and reload Nginx:

sudo ln -s /etc/nginx/sites-available/webmail /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

Don't forget to add the webmail.example.com A record in DNS and a certificate for that hostname from episode 6. If SSL uses a different hostname, adjust the certificate paths.

#Setting Up the Roundcube Database

Roundcube stores user settings, contacts, and cache in its own MySQL database (separate from the maildb virtual users database):

sudo mysql -e "CREATE DATABASE roundcubemail;"
sudo mysql -e "CREATE USER 'roundcube'@'localhost' IDENTIFIED BY 'ganti-password';"
sudo mysql -e "GRANT ALL ON roundcubemail.* TO 'roundcube'@'localhost';"

The table schema is created automatically by the web installer — you only need to provide the credentials.

#Web Installer and config.inc.php

Open https://webmail.example.com/installer in your browser. The installer guides you step by step: prerequisite checks, database connection, and config.inc.php generation. The most important part is on the Mail server settings tab. Rather than editing the PHP file manually, Roundcube 1.7 provides bin/console config set to set values safely:

php /var/www/webmail/bin/console config set db_dsnw 'mysql://roundcube:ganti-password@localhost/roundcubemail'
php /var/www/webmail/bin/console config set default_host localhost
php /var/www/webmail/bin/console config set imap_host 'ssl://localhost:993'
php /var/www/webmail/bin/console config set smtp_host 'ssl://localhost:465'
php /var/www/webmail/bin/console config set smtp_user '%u'
php /var/www/webmail/bin/console config set smtp_pass '%p'

A quick explanation:

• db_dsnw — the Roundcube database connection.
• default_host — the IMAP host used when users don't type one.
• imap_host / smtp_host — the IMAP and SMTP endpoints, both with mandatory TLS.
• smtp_user / smtp_pass — Roundcube uses the user's login credentials (%u / %p) for SMTP authentication, not a separate account.

After the installer writes the file, move it to a safe location and set the right permissions:

sudo cp /var/www/webmail/config/config.inc.php /var/www/webmail/config/config.inc.php
sudo chown -R www-data:www-data /var/www/webmail

#Removing the Installer Folder

This step is mandatory — a left-open installer is a vulnerability every attacker knows about. Remove the installer directory and verify:

sudo rm -rf /var/www/webmail/installer

To make sure the installation is healthy, check the error log and the main page:

sudo tail -n 20 /var/log/nginx/error.log
php /var/www/webmail/bin/console version

bin/console version shows the active Roundcube version — check that the number matches the download (1.7.2).

#Additional Hardening

A few habits that are mandatory from day one:

• Firewall — webmail can be opened from anywhere, but direct IMAP/SMTP exposure to the public can be restricted. Episode 16 will lay out a complete port policy.
• Login rate limit — enable login_throttle in the config to slow down brute force.
• Session hardening — use samesite = Lax on cookies and make sure only HTTPS serves webmail.

#Conclusion

Episode 8 is done. Key takeaways:

• Roundcube 1.7 requires the public_html/ docroot and PHP 8.1+.
• imap_host/smtp_host point to Dovecot and Postfix with TLS; %u/%p use user credentials.
• The Roundcube database is separate from the virtual users database.
• Remove the installer folder — a non-negotiable security step.
• bin/console version verifies the active version.

Webmail is alive. In episode 9 we go down to the mailbox level: Mailbox, Maildir, and LMTP Delivery — how messages are actually stored in the cur/new/tmp directories and delivered via LMTP. See you in episode 9!