Setup Roundcube Webmail on CentOS Linux
– Install Centos 7
– Configure networking
– Disable selinux
– Uninstall sendmail

systemctl stop sendmail
systemctl disable sendmail
yum remove -y sendmail

– Install php

yum install -y php

– Enable EPEL repository:

cd /tmp
wget wget http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
rpm -ivh epel-release-latest-7.noarch.rpm

– Enable the REMI repository (for ImageMagick, etc):

cd /tmp
wget http://rpms.famillecollet.com/enterprise/remi-release-7.rpm
rpm -ivh remi-release-7.rpm
vi /etc/yum.repos.d/remi-php54.repo (set "enabled=1" - because the current system has PHP version 5.4 installed. There are repo files for other PHP versions in the same directory)

– Add both the email domain name and the server’s FQDN as aliases to the “127.0.0.1” entry in file /etc/hosts
– Add another line to /etc/hosts for the server’s primary IP address mapping it to its short name and its FQDN
# cat /etc/hosts

127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 itayemi.com myserver1.itayemi.com
192.168.109.10 myserver1.itayemi.com myserver1

– Allow incoming/outgoing connections through the firewall for apps:

firewall-cmd --permanent --zone=public --add-service=http
firewall-cmd --permanent --zone=public --add-service=https
firewall-cmd --permanent --zone=public --add-service=imap
firewall-cmd --permanent --zone=public --add-service=imaps
firewall-cmd --permanent --zone=public --add-service=pop3s
firewall-cmd --permanent --zone=public --add-service=smtp
firewall-cmd --permanent --zone=public --add-service=smtps
firewall-cmd --permanent --zone=public --add-service=dns
firewall-cmd --reload

– Configure Postfix

yum install -y postfix
systemctl enable postfix
yum update postfix
systemctl start postfix
systemctl status postfix

– Configure Postfix

cd /tmp
openssl req -x509 -nodes -newkey rsa:2048 -keyout mailserver.key -out mailserver.crt -nodes -days 730
mkdir /etc/postfix/ssl
mv mailserver.key /etc/postfix/ssl
mv mailserver.crt /etc/postfix/ssl
chmod -R 660 /etc/postfix/ssl

vi /etc/postfix/master.cf (uncomment the following lines)
#submission inet n - n - - smtpd
# -o syslog_name=postfix/submission
# -o smtpd_tls_security_level=encrypt
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING

vi /etc/postfix/main.cf (uncomment the myhostname variable and set its value to the server's hostname)

vi /etc/postfix/main.cf (uncomment the mydomain variable and set it to the domain to receive emails for)

vi /etc/postfix/main.cf (uncomment the following lines)
#inet_interfaces = all
#inet_protocols = all
#mydestination = $myhostname, localhost.$mydomain, localhost
#home_mailbox = Maildir/

vi /etc/postfix/main.cf (add the following lines to the end of the file)
smtpd_tls_key_file = /etc/postfix/ssl/mailserver.key
smtpd_tls_cert_file = /etc/postfix/ssl/mailserver.crt
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_security_level=may

– Change the home_mailbox parameter for Postfix in file /etc/postfix/main.cf to match the dovecot config as follows (uncomment if necessary):

home_mailbox = Maildir/

– Add the hostname and domainname to mydestination parameter in the Postfix configuration file /etc/postfix/main.cf or you will get the “mail loops back to myself” error when attempting to send to local users.

mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain

– Restart postfix:

systemctl restart postfix
systemctl status postfix

– Test Postfix with telnet (send a test mail to another local user then check that user’s /home/username/Maildir/new/ directory for the mail file)

yum install -y telnet
telnet localhost 25
quit

– Install and Configure Dovecot

yum install -y dovecot
systemctl enable dovecot
systemctl start dovecot
systemctl status dovecot

Edit config file /etc/dovecot/dovecot.conf and uncomment the line below:

protocols = imap pop3 lmtp

– Edit the file /etc/dovecot/conf.d/10-auth.conf and set the following parameters (also uncomment them as well):

disable_plaintext_auth = no
auth_mechanisms = plain login

– Edit the file /etc/dovecot/conf.d/10-master.conf and set the following section to:

unix_listener auth-userdb {
#mode = 0666
user = postfix
group = postfix
}

– Set the dovecot mail_location parameter in the file /etc/dovecot/conf.d/10-mail.conf  (Uncomment the line and change the value).

mail_location = maildir:~/Maildir

– Configure dovecot for pop3 via the file /etc/dovecot/conf.d/20-pop3.conf (Uncomment or add the following lines):

pop3_uidl_format = %08Xu%08Xv
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh

– Restart dovecot to activate all the configuration changes:

systemctl restart dovecot

– Create the Maildir folder in the skeletons folder so that future users are created with the folder automatically (manually create it for all existing users and change the ownership accordingly)

mkdir -p /etc/skel/Maildir/{cur,new,tmp}

– Install and configure fetchmail and procmail (if required)

yum install -y fetchmail
yum install -y procmail
which procmail

– Install and Configure Apache webserver

yum install -y httpd
systemctl enable httpd
systemctl start httpd
systemctl status httpd

– Install Roundcube

yum install -y mysql mariadb-server php php-common php-json php-xml php-mbstring
systemctl enable mariadb
systemctl start mariadb
systemctl status mariadb
mysql -u root -p (Just press ENTER when prompted for the password)
MariaDB [(none)]> create database roundcube_db;
MariaDB [(none)]> grant all on roundcube_db.* to roundcube_user@localhost identified by 'roundcube_db_password';
MariaDB [(none)]> select user from  mysql.user;
MariaDB [(none)]> quit

NOTE: substitute your own username and password for “roundcube_user” and “roundcube_db_password” in the “grant” command above.

cd /var/www/html/
wget https://github.com/roundcube/roundcubemail/releases/download/1.3.7/roundcubemail-1.3.7-complete.tar.gz
tar -zxvf roundcubemail-1.3.7-complete.tar.gz
mv roundcubemail-1.3.7 roundcube
chown -R apache:apache roundcube

– Install various PHP extensions (that are not installed by default)

yum install -y php-pdo
yum install -y php-intl
yum install -y php-gd
yum install -y php-pear
yum install -y php-pecl-imagick
yum install -y php-mysql
yum install -y php-ldap

– Set your timezone in /etc/php.ini (e.g., add the following line to the file)

date.timezone=Africa/Lagos

– Restart Apache webserver to detect the changes:

systemctl restart httpd

– Complete the install by using the URL http://servername-or-ip/roundcube/installer
– 1. Check environment – install any missing but required PHP extensions, DB, etc
– 2. Create config – make changes as required to various config options including the database parameters (name, user, user password – created earlier). At the end, click the “Create Config” button which creates and stores the config file defaults.inc.php in the roundcube config directory (/var/www/html/roundcube/config/). Click the “CONTINUE” button.
– 3. Test config – test that roundcube can connect login to the IMAP (dovecot) and SMTP (Postfix) servers successfully
– Click the “Initialize database” button
– Scroll down and “Test SMTP config” by supplying sender/recipient email addresses
– Then “Test IMAP config” by supplying the username and password of a local user account

– 4. Delete the installer directory (or move the directory outside /var/www/html/) to prevent reconfiguration and/or unauthorized access:

rm -rf /var/www/html/roundcube/installer

– 5. Enable Roundcube’s automatic cache-cleaning (optional but recommended):

sudo crontab -u apache -l | { cat; echo "18 11 * * * /var/www/html/roundcube/bin/cleandb.sh"; } | sudo crontab -u apache -

– 6. Confirm that the parameter default_host in the Roundcube config file /var/www/html/roundcube/config/config.inc.php is set to the email domain name.

$config['default_host'] = 'itayemi.com';

– 7. Optional:  there are 2 parameters in file /etc/php.ini that controls the maximum attachment size in a single mail:  upload_max_filesize and  post_max_size. I believe upload_max_filesize  is the maximum file size of a single attached file while post_max_size is the combined maximum total of all files attached to a single mail.  The smaller of upload_max_filesize and post_max_size takes precedence. upload_max_filesize is set to 2MB by default. You likely want to increase the value of both parameters e.g., to 10MB (means the mail will accept a single file of 10MB size or a collect of smaller files totaling 10MB max).  To increase these values, edit file /etc/php.ini and increase the value of the parameters to your desired size then restart the Apache webserver:

upload_max_filesize = 10M
post_max_size = 10M

– 8. Restart Apache webserver:

systemctl restart httpd

——————————————————————————————————–

– Enable SSL for extra security

yum install mod_ssl
mkdir /etc/httpd/ssl
openssl req -x509 -nodes -days 1095 -newkey rsa:2048 -out /etc/httpd/ssl/server.crt -keyout /etc/httpd/ssl/server.key
openssl dhparam -out /etc/httpd/ssl/dhparam.pem 2048
cat /etc/httpd/ssl/dhparam.pem | tee -a /etc/httpd/ssl/server.crt
chmod -R 660 /etc/httpd/ssl

– Edit mod_ssl config file /etc/httpd/conf.d/ssl.conf
vi /etc/httpd/conf.d/ssl.conf

– Find the section that begins with “<VirtualHost _default_:443>” and uncomment the 2 lines below. Also change the ServerName parameter to your server’s name/IP
DocumentRoot “/var/www/html”
ServerName itayemi.com:443

– Find the SSLProtocol and SSLCipherSuite lines and either delete them or comment them out.

– Find the SSLCertificateFile and SSLCertificateKeyFile lines and change them to the paths to the SSL keys we created earlier:

SSLCertificateFile /etc/httpd/ssl/server.crt
SSLCertificateKeyFile /etc/httpd/ssl/server.key

– Edit the file /etc/{nginx,apache2,httpd}/etc/httpd/conf.d/ssl.conf and change X-Frame-Options to SAMEORIGIN. For example, the line “Header always set X-Frame-Options DENY” becomes “Header always set X-Frame-Options SAMEORIGIN”
Note that without this change sending appears to hang (spins but a refresh shows the mail in the Sent folder, AND more importantly, attempts to attach files to the mail throws an error and fails). Without this change, Roundcube will fail to upload attachments throwing “An error occurred! file upload failed!”.  Paste in the lines below AFTER the end of the VirtualHost block – at the end of the file:

SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains"
Header always set X-Frame-Options SAMEORIGIN
Header always set X-Content-Type-Options nosniff
SSLCompression off
SSLUseStapling on
SSLStaplingCache "shmcb:logs/stapling-cache(150000)"

– For additional security, redirect all traffic to be SSL encrypted. Create the file /etc/httpd/conf.d/non-ssl.conf with the content below (use your own servername or IP-address):

vi /etc/httpd/conf.d/non-ssl.conf

<VirtualHost *:80>
     ServerName mailserver.example.com
     Redirect "/" "https://mailserver.example.com/"
</VirtualHost>

– Restart Apache webserver:
systemctl restart httpd

– Access the Rouncube email client login page at:  https://<server-ip>/roundcube/  or https://<server-name>/roundcube/

——————————————————————————————————

References:
https://nolabnoparty.com/en/setup-mail-server-postfix-dovecot-roundcube-centos/
https://firewalld.org/documentation/howto/open-a-port-or-service.html
https://firewalld.org/documentation/howto/add-a-service.html
https://www.fastwebhost.in/blog/mysql-list-users-how-to-list-mysql-user-accounts-via-command-line/
https://www.1and1.com/cloud-community/learn/application/e-mail/set-up-a-postfix-mail-server-with-dovecot-and-roundcube-on-centos-7/
https://www.howtoforge.com/tutorial/perfect-server-centos-7-apache-mysql-php-pureftpd-postfix-dovecot-and-ispconfig/
https://www.tecmint.com/how-to-enable-epel-repository-for-rhel-centos-6-5/
https://www.vultr.com/docs/install-imagemagick-on-centos-6
https://tecadmin.net/install-imagemagick-on-centos-rhel/
https://forums.fedoraforum.org/archive/index.php/t-262200.html
https://www.digitalocean.com/community/tutorials/how-to-create-a-ssl-certificate-on-apache-for-centos-6
https://www.digitalocean.com/community/tutorials/how-to-create-an-ssl-certificate-on-apache-for-centos-7
https://hallard.me/enable-ssl-for-apache-server-in-5-minutes/
https://wiki.centos.org/HowTos/Https
https://www.linode.com/docs/email/clients/using-fetchmail-to-retrieve-email/https://support.rackspace.com/how-to/dovecot-installation-and-configuration-on-centos/https://support.plesk.com/hc/en-us/articles/115002060625-Roundcube-Attachment-and-settings-do-not-work-File-Upload-Failed
https://support.rackspace.com/how-to/dovecot-installation-and-configuration-on-centos/

For nginx (webserver):
https://linuxize.com/series/setting-up-and-configuring-a-mail-server/
https://linuxize.com/post/install-and-configure-roundcube-webmail/

OTHER USEFUL NOTES
————————————————————————
– Fetchmail does not seem to come with control scripts, but if you create them yourself (under /etc/init.d and links to /etc/rc.d/rcX.d/), systemd will pick them up

– Sample Fetchmail config that downloads mails for 3 users (5 minutes interval) from a remote mail server (IP n.n.n.n or FQDN)

# cat /root/.fetchmailrc
set syslog
set no bouncemail
set no spambounce
set daemon 300
poll n.n.n.n
with proto pop3
    username user1@mydomain.com password Password@123 is localuser1 mda "/bin/procmail -d %T"
    username anotheruser@mydomain.com password my-Password@123 is localanotheruser mda "/bin/procmail -d %T"
    username thirduser@mydomain.com password justaPassword is localeusername mda "/bin/procmail -d %T"

– Fetchmail knows to use /root/.fetchmailrc because it is defined in its startup script:
# grep fetchmailrc /etc/init.d/fetchmail
FRC=/root/.fetchmailrc
FRC=/root/.fetchmailrc

————————————————-
– If you use a relayhost (i.e., your mail server can’t send mails directly), uncomment and set the relayhost variable to your service provider’s SMTP server (and port e.g., 587) – especially necessary if they are blocking TCP port 25.
See link for sample steps for postfix: https://www.linode.com/docs/email/postfix/postfix-smtp-debian7/
————————————————-
The default postfix/fetchmail/dovecot log on CentOS/RedHat/Oracle_Linux is /var/log/maillog (look in the file for troubleshooting)
————————————————-

– If you have mails in /var/mail/ (e.g., because you were using Sendmail before) and you want that mail to be accessible in Roundcube or other email clients such as Outlook, you may need to use the mbox format instead of the Maildir folder, i.e., change the mail_location in file /etc/dovecot/conf.d/10-mail.conf as follows.

NOTE: If you switch to the mbox format, make sure the permission on INBOX files in /var/mail/ is 0600

• If you would rather “migrate” the old mails in mbox format to the Maildir format (recommended for Postfix/Dovecot), you may need to use the mb2md utility.
  The mail_location in dovecot’s configuration remains as before:
  # grep mail_location  /etc/dovecot/conf.d/10-mail.conf
  mail_location = maildir:~/Maildir
  # Install mb2md mail formatconverter utility
  yum install -y mb2md-3.20-17.el7.noarch# Migrate each existing user’s old mails with the command below:
  su – <username>
  mb2md -m -d ~/Maildir/

   

  # NOTE: I tried both dsync and doveadm for the migration but got inconsistent results – not all mails were migrated or the commands just errored out with a core dump.

Refence link: https://wiki2.dovecot.org/Errors/ChgrpNoPerm