- Users - Roundcube mailing lists

Security Update 1.3.6 released
by Thomas Bruederli 11 Apr '18

11 Apr '18

Dear subscribers We just published a security update to the stable version 1.3. It primarily fixes a recently reported IMAP command injection vulnerability caused by insufficient input validation within the archive plugin. Details about the vulnerability are published under CVE-2018-9846. Additionally, we back-ported some minor fixes from the master branch which improve PHP 7.2 compatibility as well as PGP signing and key handling for those who use the Enigma plugin. See the full changelog in the release notes on the Github download page: https://github.com/roundcube/roundcubemail/releases/tag/1.3.6 We strongly recommend to update all productive installations of Roundcube with this new version. Updates for older LTS versions will follow soon. And as usual: please do backup your data before updating! Best, Alec & Thomas

1 0

Roundcube Carddav and Enigma plugins
by David Mehler 10 Apr '18

10 Apr '18

Hello, I'm wanting to get the carddav and enigma plugins going. When I turn on carddav then attempt a log in I get a blank screen. Whenever I turn on enigma I am wanting to make keys, this does not appear possible. Any suggestions welcome. Thanks. Dave.

2 7

markasjunk2 plugin using rspamd
by David Mehler 10 Apr '18

10 Apr '18

Hello, Is it possible to hook the markasjunk2 plugin in with rspamd? I'd like to either mark a message as junk or not junk and have rspamd be retrained. Thanks. Dave.

1 0

roundcube custom tls verification options
by David Mehler 09 Apr '18

09 Apr '18

Hello, Is it possible to do custom connection information? This is how my config.inc.php file looks: $config['default_host'] = 'tls://localhost'; $config['imap_conn_options'] = array( 'ssl' => array( 'verify_peer' => false, 'verify_peer_name' => false, ), ); $config['smtp_server'] = 'tls://localhost'; $config['smtp_conn_options'] = array( 'ssl' => array( 'verify_peer' => false, 'verify_peer_name' => false, ), ); $config['include_host_config'] = array( 'webmail.domain1.com' => 'domain1_config.inc.php', 'webmail.domain2.com' => 'domain2_config.inc.php', ); what I'm wanting to do is tighten my tls verification options. My domains each use a different letsencrypt certificate. What I'm wanting to add is something like: // For STARTTLS IMAP $config['imap_conn_options'] = array( 'ssl' => array( 'verify_peer' => true, // certificate is not self-signed if cafile provided 'allow_self_signed' => false, // 'cafile' => '/etc/ssl/certs/Your_CA_certificate.pem', // For Letsencrypt use the following two lines and remove the 'cafile' option above. 'ssl_cert => '/etc/letsencrypt/live/mail.my_domain.org/fullchain.pem' 'ssl_key' => '/etc/letsencrypt/live/mail.my_domain.org/privkey.pem' // probably optional parameters 'ciphers' => 'TLSv1+HIGH:!aNull:@STRENGTH', 'peer_name' => 'mail.my_domain.org', ), ); // For STARTTLS SMTP $config['smtp_conn_options'] = array( 'ssl' => array( 'verify_peer' => true, // certificate is not self-signed if cafile provided 'allow_self_signed' => false, // 'cafile' => '/etc/ssl/certs/Your_CA_certificate.pem', // For Letsencrypt use the following two lines and remove the 'cafile' option above. 'ssl_cert => '/etc/letsencrypt/live/mail.my_domain.org/fullchain.pem' 'ssl_key' => '/etc/letsencrypt/live/mail.my_domain.org/privkey.pem' // probably optional parameters 'ciphers' => 'TLSv1+HIGH:!aNull:@STRENGTH', 'peer_name' => 'mail.my_domain.org', ), ); Can I put a config in each of the domain specific files? Thanks. Dave.

3 3

Print ALL mails in a folder to PDF files
by Philip Rhoades 08 Apr '18

08 Apr '18

People, Is there some way of CLI scripting RCM to print all the mails in a particular Maildir to separate PDF files? - it would be far to slow to do one at a time from the GUI . . Thanks, Phil. -- Philip Rhoades PO Box 896 Cowra NSW 2794 Australia E-mail: phil(a)pricom.com.au

1 0

feature request
by Webert de Souza Lima 06 Apr '18

06 Apr '18

Because of the problem I have described recently in the email entitled: "Unable to send command: A0007 FETCH 1:* (UID BODY.PEEK[HEADER.FIELDS (FROM)])" I would like to request a feature: clear ordering preference. That would make the sort as the default again. How is that likely to be done? I'm not sure I can request any features. Regards, Webert Lima DevOps Engineer at MAV Tecnologia *Belo Horizonte - Brasil* *IRC NICK - WebertRLZ*

2 3

problem with the carddav plugin
by David Mehler 04 Apr '18

04 Apr '18

Hello, I'm running the latest roundcube stable. I am having an issue with the carddav plugin. When I load it and restart apache to resource the roundcube I am seeing this in the roundcube/logs/errors file: [04-Apr-2018 12:40:32 America/New_York] PHP Warning: dns_get_record(): DNS Query failed in /usr/local/www/roundcube/plugins/carddav/carddav_discovery.php on line 207 [04-Apr-2018 12:40:32 America/New_York] PHP Warning: usort() expects parameter 1 to be array, boolean given in /usr/local/www/roundcube/plugins/carddav/carddav_discovery.php on line 220 [04-Apr-2018 12:40:32 America/New_York] PHP Warning: Invalid argument supplied for foreach() in /usr/local/www/roundcube/plugins/carddav/carddav_discovery.php on line 224 [04-Apr-2018 12:40:32 America/New_York] PHP Warning: dns_get_record(): DNS Query failed in /usr/local/www/roundcube/plugins/carddav/carddav_discovery.php on line 252 [04-Apr-2018 12:40:32 America/New_York] PHP Warning: Invalid argument supplied for foreach() in /usr/local/www/roundcube/plugins/carddav/carddav_discovery.php on line 253 [04-Apr-2018 12:40:32 America/New_York] PHP Fatal error: Call to undefined function raise_error() in /usr/local/www/roundcube/plugins/recipient_to_contact/recipient_to_contact.php on line 61 I have not altered carddav_discovery.php in any way. If anyone has a fix i'd love to know it. Thanks. Dave.

1 0

Useradd to MySQL
by Andreas Meyer 02 Apr '18

02 Apr '18

Hello! I just stumble a bit understanding at what time a user is added to the db-table roundcubemail/users. Usually my users are stored in the db mailbox at the server. Is the db roundcubemail used at all then? Kind regards Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

2 1

roundcube quota
by David Mehler 02 Apr '18

02 Apr '18

Hello, I've got a postfix virtual mail server setup going and using Roundcube as webmail. I've got MySQL database serving quota and both Dovecot and Postfix are configured to utilize it. I'd like to get roundcube working with quota. I'd appreciate any suggestions. Thanks. Dave.

3 3

managesieve plugin
by mick crane 02 Apr '18

02 Apr '18

hello, having some bother getting managesieve plugin to work. worked with previous install of roundcube, was called managesieve in webpage settings/filters now is called roundcube. Is writing filter rules to ~/sieve/roundcube.sieve but emails are not moved. is Roundcube Webmail 1.3.5. Debian testing. dovecot --version 2.2.35 (b1cb664) is just for local network. I don't know what is the problem. Probably something dumb. did these things from various destructions on internet > apt-get install dovecot-sieve dovecot-managesieved --- > in /etc/dovecot/conf.d/20-lmtp.conf we add this: > protocol lmtp { > postmaster_address = postmaster(a)YOUR-DOMAIN.com > mail_plugins = $mail_plugins sieve > } (didn't have 20-lmtp.conf but installed it just in case that was the problem) apt install dovecot-lmtpd ---- > edit /etc/dovecot/conf.d/90-sieve.conf and inside “plugin” > configuration add: > sieve = ~/.dovecot.sieve > sieve_global_path = /var/lib/dovecot/sieve/default.sieve > sieve_dir = ~/sieve > sieve_global_dir = /var/lib/dovecot/sieve/ (left this bit alone as sieve = file:~/sieve;active=~/.dovecot.sieve was already there, there is a link in ~/ to ~/sieve/roundcube.sieve) ---- > edit /etc/dovecot/conf.d/20-managesieve.conf for enable listing on port > 4190, >this should be >the top of config file: > ## > ## ManageSieve specific settings > ## > > protocols = $protocols sieve > > # Service definitions > > service managesieve-login { > inet_listener sieve { > port = 4190 > } (can't remember if this was there or not but is now ) ---- > service dovecot restart ---- > > If you try to telnet 4190 it should answer as follow > > root@server:/# telnet 127.0.0.1 4190 ( this works get # telnet 127.0.0.1 4190 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. "IMPLEMENTATION" "Dovecot (Debian) Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext" "NOTIFY" "mailto" "SASL" "PLAIN" "STARTTLS" "VERSION" "1.0" OK "Dovecot ready." ) ---- > Activate the plugin in roundcube config file > roundcube_folder/config/config.inc.php: > $rcmail_config['plugins'] = array(......, 'sieverules'); don't have sieverules plugin have managesieve and is $config['plugins'] not rcmail_config ---------- # telnet 127.0.0.1 143 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE START TLS AUTH=PLAIN] Dovecot ready. mick -- Key ID 4BFEBB31

1 1

Re: [RCU] managesieve plugin
by mick crane 01 Apr '18

01 Apr '18

On 2018-04-01 21:21, Reindl Harald wrote: > > breaking news: paths may differ and files can be created > > since i don't use dovecot at all nor offer sieve to the public i'm done > here, the point was that sieve is a service/protocol on the mailserver > and not just random files in the webmail installation - normally you > don't even run any webserver on the mail machine at all clearly but this is not facing the big bad world. thanks for your efforts. all I want to do is put mail in folders. did it before with procmail if I can't sort this shortly will try some other way. mick -- Key ID 4BFEBB31

1 0

Re: [RCU] managesieve plugin
by mick crane 01 Apr '18

01 Apr '18

On 2018-04-01 20:02, Reindl Harald wrote: > Am 01.04.2018 um 20:57 schrieb mick crane: >> On 2018-04-01 19:36, Reindl Harald wrote: >>> Am 01.04.2018 um 19:59 schrieb mick crane: >>>> having some bother getting managesieve plugin to work. >>>> worked with previous install of roundcube, was called managesieve in >>>> webpage settings/filters >>>> now is called roundcube. >>>> Is writing filter rules to ~/sieve/roundcube.sieve but emails are >>>> not >>>> moved. >>>> is Roundcube Webmail 1.3.5. Debian testing. dovecot --version >>>> 2.2.35 >>>> (b1cb664) >>> >>> are you aware that sievie normally is a *network service* as you even >>> quoted here and hence normally you don't spit files from a website >>> around to configure your mailserver: >> >> yes well, it is just for me, there is no school near here for this >> stuff >> so rely on things like the dovecot wiki pages to set up. > > you didn't get it > > https://wiki.dovecot.org/Pigeonhole/ManageSieve > https://tools.ietf.org/html/rfc5804 > > you don't create local files from the client - you speak over TCP last time I think I installed pigeonhole and it *just worked* can't find pigeonhole anymore in debian repository is dovecot-sieve and dovecot-managesieve > https://www.rosehosting.com/blog/how-to-set-up-server-side-email-filtering-… > > copy the default configuration file and set the following: > > ## cp config.inc.php.dist config.inc.php > ## vim config.inc.php > ... > $rcmail_config['managesieve_port'] = 4190; before that it says edit Roundcube’s main configuration file and set the following: ## vim +/PLUGINS config/main.inc.php ... $rcmail_config['plugins'] = array('managesieve'); I don't have main.inc.php I guess that is roundcubemail/config.inc.php. > ... > $rcmail_config['managesieve_default'] = > '/etc/dovecot/sieve/default.sieve'; > I don't have /etc/dovecot/sieve >>> ________________ >>> >>> edit /etc/dovecot/conf.d/20-managesieve.conf for enable listing on >>> port >>> 4190, >this should be >the top of config file: >>> ## >>> ## ManageSieve specific settings >>> ## >>> >>> protocols = $protocols sieve >>> >>> # Service definitions >>> >>> service managesieve-login { >>> inet_listener sieve { >>> port = 4190 >>> } >> >> this is there at the top -- Key ID 4BFEBB31

1 0

Re: [RCU] managesieve plugin
by mick crane 01 Apr '18

01 Apr '18

On 2018-04-01 19:36, Reindl Harald wrote: > Am 01.04.2018 um 19:59 schrieb mick crane: >> having some bother getting managesieve plugin to work. >> worked with previous install of roundcube, was called managesieve in >> webpage settings/filters >> now is called roundcube. >> Is writing filter rules to ~/sieve/roundcube.sieve but emails are not >> moved. >> is Roundcube Webmail 1.3.5. Debian testing. dovecot --version 2.2.35 >> (b1cb664) > > are you aware that sievie normally is a *network service* as you even > quoted here and hence normally you don't spit files from a website > around to configure your mailserver: yes well, it is just for me, there is no school near here for this stuff so rely on things like the dovecot wiki pages to set up. > ________________ > > edit /etc/dovecot/conf.d/20-managesieve.conf for enable listing on port > 4190, >this should be >the top of config file: > ## > ## ManageSieve specific settings > ## > > protocols = $protocols sieve > > # Service definitions > > service managesieve-login { > inet_listener sieve { > port = 4190 > } this is there at the top. -- Key ID 4BFEBB31

1 0

Unable to send command: A0007 FETCH 1:* (UID BODY.PEEK[HEADER.FIELDS (FROM)])"
by Webert de Souza Lima 27 Mar '18

27 Mar '18

Hello, I use Roundcube as my main Webmail client and Dovecot as the underlying mail server. Very often, users stumble across the error stated in the subject of this message: * "Unable to send command: A0007 FETCH 1:* (UID BODY.PEEK[HEADER.FIELDS (FROM)])"".* After some research I have learned that this message itself is not where the problem lies, but it's the previous step, where it asks the imap server to sort the fetched headers by date: * "A0006 UID SORT (DATE) US-ASCII ALL"* After some efforts I have learned that Roundcube takes the following steps when opening a given mailbox: Regards, Webert Lima DevOps Engineer at MAV Tecnologia *Belo Horizonte - Brasil* *IRC NICK - WebertRLZ*

2 5

HTML Fonts
by Webert de Souza Lima 27 Mar '18

27 Mar '18

Hello, does roundcube support adding new fonts for html signature/composing? Regards, Webert Lima DevOps Engineer at MAV Tecnologia *Belo Horizonte - Brasil* *IRC NICK - WebertRLZ*

1 1

Request security check failed
by Jorge Bastos 23 Mar '18

23 Mar '18

Hi there, I'm tailing logs to make my installation the stable'est possible, and once in a while I see this in the logs. Should I worry? What does it mean? Mar 23 17:24:37 fastweb roundcube: <9j959159> PHP Error: Request security check failed (POST /webmail/?_task=mail&_action=refresh)

1 0

Rouncdube username problems
by jsmosc 23 Mar '18

23 Mar '18

Hello! Using Centos 7/64 and Webmin/Virtualmin, I have setup Roundcube for one domain (mydomain.com). All is working fine but I have a couple of problems with usernames. First, I wrote an interface to automatically create users at the domain, in Virtualmin (using the Virtualmin API). There, creating a user "test" will make it recorded as "test.mydomain". To log into RoundCube I must enter test.mydomain as username. Then, the RC record of this user is: username: test.mydomain email: test.mydomain(a)mydomain.com I would like this to be: username: test email: test(a)mydomain.com And I would like users to login as "test", simply. Or eventually (but it is worse as "test(a)mydomain.com". I tried changing the config.inc.php details: The defaul was: $config['default_host'] = 'localhost'; I setup $config['default_host'] = 'mydomain.com'; and tried a few things with $config['mail_domain'] and $config['username_domain'] (options %n , %s, etc The result is never what I need... Any suggestion would be welcome, Thank you!

1 0

inbox has no "old" content
by Thing 23 Mar '18

23 Mar '18

Hi, I am just trying to migrate my mail server from Debian 7 on a pi2 using sendmail, dovecot and squirrel-mail to debian9 on a x86 server using sendmail, dovecot and roundcube. So waht I have done is tar zcvf the user's home folder and expanded it on the new server. When I log in with roundcube my inbox is empty but all the old folders are there and have content. I am assuming I have some config to do to get inbox populated but Im scrathcing my head as to what to look at. When i use Thunderbird client instead I get the same issue, so am I right in assuming its a Dovecot issue?

2 1

Re: [RCU] different language
by Andreas Meyer 21 Mar '18

21 Mar '18

Am 21.03.2018 23:02, schrieb Reindl Harald: > which version from which source (tarball, distro-package..) tarball Roundcube 1.3.3 >> In Firefox german is the preffered language > the UI language don't matter - don't confuse langpack under addons for > the browser UI with the preferred content language you can chosse in > the settings between fonts and downloads Could it has something to do with that accidently I logged in one domain-interface to another domain/mailaccount? Kind regards Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

1 0

different language
by a.meyer＠nimmini.de 21 Mar '18

21 Mar '18

Hello! Today I installed CentOS and am curious Roundcube has english language after logging in. Is this a browser thing? In Firefox german is the preffered language. Kind regards Andreas

1 0

Re: [RCU] Roundcube Webmail 1.3.5 released
by A.L.E.C 16 Mar '18

16 Mar '18

On 15.03.2018 23:18, Jorge Bastos wrote: > Hi Thomas, > > Thank you and Alec for new relase! > > Just curious, 1.4 has any date already? April or May for the beta release and around 3 months more for stable. -- Aleksander 'A.L.E.C' Machniak Kolab Groupware Developer [http://kolab.org] Roundcube Webmail Developer [http://roundcube.net] ---------------------------------------------------- PGP: 19359DC1 # Blog: https://kolabian.wordpress.com

2 1

Roundcube Webmail 1.3.5 released
by Thomas Bruederli 15 Mar '18

15 Mar '18

Dear subscribers We proudly announce a new service release to update the stable version 1.3. It contains fixes to some issues which we backported from the master branch. One can be called a minor security fix as it fixes blocking of remote content on specially crafted style tags. See the full changelog in the release notes on the Github download page [1]. This release is considered stable and we recommend to update all productive installations of Roundcube with this version. Download it from https://roundcube.net. And stay tuned for the upcoming 1.4 beta release which will include a preview to the new "Elastic" theme. Apropos: we're still looking for a volunteer designer to do the final polishing on the new skin. Read about the progress of the Elastic skin in Alec's blog [2]. Best, Thomas & Alec [1] https://github.com/roundcube/roundcubemail/releases/tag/1.3.5 [2] https://kolabian.wordpress.com/tag/elastic/

2 1

Pop3 push
by Jorge Bastos 14 Mar '18

14 Mar '18

Hi, Is there any plugin for pop3 push? Even that is a commercial one? Thanks in advanced,

1 0

roundcube password plugin changing mysql password
by David Mehler 09 Mar '18

09 Mar '18

Hello, I'm a first time poster. I use Roundcube 1.3.4 on a FreeBSD system. I use postfix which gets it's authentication from dovecot imap server and goes to a MySQL database. I am now wanting to get roundcube's password plugin to be able to change a users password. In the password plugin configuration file I had this originally: update virtual_users set password=CONCAT('{SHA512-CRYPT}', ENCRYPT (%p, CONCAT('$6$', SUBSTRING(SHA(RAND()), -16)))) WHERE user=%u; This didn't work nor did it return any debug information. I then went in to MySQL directly and did this: update virtual_users set password=CONCAT('{SHA512-CRYPT}', ENCRYPT ('PasswordGoesHere', CONCAT('$6$', SUBSTRING(SHA(RAND()), -16)))) WHERE user='Username goes here'; Directly at the MySQL prompt this worked replaced user and password with values and it got returned correctly. I then did this with %p and %u as it appeared that not having them quoted was causing an error. Through none of this am I getting any kind of debug or log output: update virtual_users set password=CONCAT('{SHA512-CRYPT}', ENCRYPT ('%p', CONCAT('$6$', SUBSTRING(SHA(RAND()), -16)))) WHERE user='%u'; I try to change the password and I get brought back to the same screen, no errors on the screen and nothing in a log, the password does not get changed. Any suggestions or ways I can get some logging information? Also, when doing the change at the MySQL prompt I got a warning, doing a show warnings revealed error 1287 that the ENCRYPT function is deprecated and to use AES_ENCRYPT instead. I tried replacing ENCRYPT with AES_ENCRYPT and that didn't work. Any suggestions on either issue welcome. Thanks. Dave.

1 1

Roundcube Display HTML
by Mario Jorge Lima 08 Mar '18

08 Mar '18

Hi, If I let Roundcube to "DISPLAY HTML" for any account, I receive a Error 500 when trying to open an email. WHen I deselect it in "Roundcube >> Settings >> Preferences >> Displaying Messages" everything works. So I need one of these: 1) To solve this Error 500 or 2) To deselect this parameter above for any account, is there a way of setting it as a global parameter? Mario./ ___________________________ Mario Jorge Lima mariolima(a)multisites.com.br OBS: Eventualmente nao acentuo algumas palavras do Portugues, para evitar bugs na recepcao dos emails.

2 3

Does RCM support MIME Digests? ie so replying to an item in a digest doesn't break the thread . .
by Philip Rhoades 07 Mar '18

07 Mar '18

People, IT looks like RCM can't do this? Thanks, P. -- Philip Rhoades PO Box 896 Cowra NSW 2794 Australia E-mail: phil(a)pricom.com.au

2 4

Fontsize
by Andreas Meyer 05 Mar '18

05 Mar '18

Hi! A user complains the font being to small. Can the fontsize be set? Kind regards Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

4 5

Cannot send mail via round cube
by ɹןʇnqן 03 Mar '18

03 Mar '18

Mar 1 09:27:02 mail submit-tls/smtpd[86118]: connect from localhost[127.0.0.1] Mar 1 09:27:02 mail submit-tls/smtpd[86118]: SSL_accept error from localhost[127.0.0.1]: 0 Mar 1 09:27:02 mail submit-tls/smtpd[86118]: warning: TLS library problem: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca:/usr/src/crypto/openssl/ssl/s3_pkt.c:1493:SSL alert number 48: Mar 1 09:27:02 mail submit-tls/smtpd[86118]: lost connection after STARTTLS from localhost[127.0.0.1] Mar 1 09:27:02 mail submit-tls/smtpd[86118]: disconnect from localhost[127.0.0.1] ehlo=1 starttls=0/1 commands=1/2 Sending mail on the submission port outside of roundcube works fine. Mar 1 09:35:35 mail submit-tls/smtpd[26307]: connect from unknown[24.71.178.2] Mar 1 09:35:36 mail submit-tls/smtpd[26307]: Anonymous TLS connection established from unknown[24.71.178.2]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits) Mar 1 09:35:36 mail submit-tls/smtpd[26307]: NOQUEUE: permit: RCPT from unknown[24.71.178.2]: action=permit_sasl_authenticated for Client host=unknown[24.71.178.2] ; from=<lbutler(a)covisp.net> to=<user(a)example.net> proto=ESMTP helo=<[10.0.2.45]> Mar 1 09:35:36 mail last message repeated 2 times Mar 1 09:35:36 mail submit-tls/smtpd[26307]: 3zsdMr46Q6zbRf3: client=unknown[24.71.178.2], sasl_method=PLAIN, sasl_username=lbutler -- L Butler 303 219 0564

7 15

Re: [RCU] Cannot send mail via round cube
by Maarten 03 Mar '18

03 Mar '18

When roundcube connects to an imap or smtp server it's being a client therefore I think it would be logical that the client needs to validate the chain. When you are connecting to roundcube webinterface you are connecting to the server serving it, in that setting the browser is the client and the apache/nginx being the server. It's all a matter of who is the client and who is the server perspective as in who needs to validate and who needs to show they have a valid chain. On 03/03/2018 12:44 PM, Reindl Harald wrote: > > > Am 03.03.2018 um 12:29 schrieb Reindl Harald: >> Am 03.03.2018 um 10:08 schrieb Maarten: >>> If I understand ssl correctly I don't see the point to putting >>> fullchain.pem letsencrypt there, because of the following. Your browser >>> has the Root certificates installed, a php application does not. So >>> when >>> >>> you go to a webpage using letsencrypt certificates . You will see >>> something like this: >>> >>> DST Root CA X2 --> Root Certificate in browser >>> >>> Let's encrypt Authority X3 --> >>> >>> webmail.yourdomain.com --> your certificate >>> >>> >>> So the web browser uses the Root Certificate to verify the chain of >>> certificates to be valid. As far as I know a php application has no way >>> knowing if the service it's connecting to is using a valid ssl chain, I >>> don't know enough about php to be sure about this but sounds >>> correct. If >>> I am wrong about this someone may correct me about this and explain it >>> to me how this works in php. >> >> exactly the same way as on the browser side >> no idea why you think PHP is special here >> >> "As far as I know a php application has no way knowing if the service >> it's connecting to is using a valid ssl chain" is pure bullshit - get >> a proper maintained operating system and you have all working >> out-of-the-box >> >> http://php.net/manual/en/migration56.openssl.php >> >> All encrypted client streams now enable peer verification by default. >> By default, this will use OpenSSL's default CA bundle to verify the >> peer certificate. In most cases, no changes will need to be made to >> communicate with servers with valid SSL certificates, as distributors >> generally configure OpenSSL to use known good CA bundles > it's using even the same ca-bundle than everything else on the system, > the ca-bundle from mozilla - frankly do you think the php-devleopers > are idiots and enable verification by default when it won't work on > any reasonable server? > > [harry@srv-rhsoft:~]$ rpm -q --filesbypkg > openssl-libs-1.1.0g-1.fc27.x86_64 > openssl-libs /etc/pki/tls > openssl-libs /etc/pki/tls/certs > openssl-libs /etc/pki/tls/misc > openssl-libs /etc/pki/tls/openssl.cnf > openssl-libs /etc/pki/tls/private > .... > > [harry@srv-rhsoft:~]$ ls /etc/pki/tls/certs > total 4.0K > -rw-r--r-- 1 root root 2.5K 2017-11-06 09:24 Makefile > lrwxrwxrwx 1 root root 49 2018-02-06 14:48 ca-bundle.crt -> > /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem > lrwxrwxrwx 1 root root 55 2018-02-06 14:48 ca-bundle.trust.crt -> > /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt > > [harry@srv-rhsoft:~]$ rpm -q --file > /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem > ca-certificates-2018.2.22-1.0.fc27.noarch > > [harry@srv-rhsoft:~]$ rpm -q --info > ca-certificates-2018.2.22-1.0.fc27.noarch > Name : ca-certificates > Version : 2018.2.22 > Release : 1.0.fc27 > Architecture: noarch > Install Date: Thu Feb 8 09:43:10 2018 > Group : System Environment/Base > Size : 974873 > License : Public Domain > Signature : RSA/SHA256, Tue Feb 6 14:57:19 2018, Key ID > f55e7430f5282ee4 > Source RPM : ca-certificates-2018.2.22-1.0.fc27.src.rpm > Build Date : Tue Feb 6 14:48:33 2018 > Build Host : buildvm-ppc64le-04.ppc.fedoraproject.org > Relocations : (not relocatable) > Packager : Fedora Project > Vendor : Fedora Project > URL : https://fedoraproject.org/wiki/CA-Certificates > Summary : The Mozilla CA root certificate bundle > Description : > This package contains the set of CA certificates chos

1 0

Size of attachments
by Andreas Meyer 01 Mar '18

01 Mar '18

Hello! Writing a mail on the right side I see "maximun allowed size is 5,0 MB. Where is this value set? Kind regards Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

1 1

another PGP thingi
by Andreas Meyer 01 Mar '18

01 Mar '18

Hello! I run two domains on one host. With one I have no problem using PGP with the otherone it does not work. Both domains use version 1.3.3 and enigma 0.7. Importing keys works, signing and encryption does not. I set $config['debug_level'] = 4; but nothing is logged at the moment. How can I debug that thing? I get the pinentry thing to input the passphrase and then it says signing failed. Regards Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

1 2

Re: [RCU] Design larry
by Andreas Meyer 01 Mar '18

01 Mar '18

Reindl Harald <h.reindl(a)thelounge.net> schrieb am 01.03.18 um 17:36:04 Uhr: > Am 01.03.2018 um 17:28 schrieb Andreas Meyer: > > Is it possible to not let the user choose between the styles larry > > and classic? > > surely, my rpmbuild even removes "larry" before generating the package > in the %install section > > $rcmail_config['skin'] = 'classic'; I have $config['skin'] = 'larry' already set. Nevertheless in the settings one can choose between classic and larry style. Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

2 1

Question regarding PGP
by Andreas Meyer 01 Mar '18

01 Mar '18

Hello! Is see this in the log: [01-Mar-2018 18:12:15 Europe/Berlin] PHP Warning: exec() has been disabled for security reasons in /vwww/HIDDEN/root/mailsystem/vendor/pear/crypt_gpg/Crypt/GPG/ProcessControl.php on line 143 Do I have to enable exec() in the php.ini? Kind regards Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

2 2

Design larry
by Andreas Meyer 01 Mar '18

01 Mar '18

Hello! Is it possible to not let the user choose between the styles larry and classic? Kind regards Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

1 0

How to avoid accessing mailboxes elsewhere
by Mario Jorge Lima 27 Feb '18

27 Feb '18

Hello, I will explain what I need to know. I have 3 Servers: 1) One of them is just a Domains Server. 2) The other two are Mailboxes Servers. They have the email accounts for all the Domains from the first Server. All these mailboxes' POP and SMTP are accessed through the Server address: mail.domainnamea.com. mail.domainnameb.com. mail.domainnamec.com. and so on. If someone who accesses my Roundcube, fill the Server field with any other POP Server name elsewhere, he will read those emails. How to avoid it, so that only mailboxes in one of my two Mailboxes mentioned above can be accessed? Thanks a lot. Mario./ ___________________________ Mario Jorge Lima mariolima(a)multisites.com.br OBS: Eventualmente nao acentuo algumas palavras do Portugues, para evitar bugs na recepcao dos emails.

4 4

Re: [RCU] [misc] failed to connect socket
by Roundcube 24 Feb '18

24 Feb '18

On 2018-02-23 (19:35 MST), Reindl Harald <h.reindl(a)thelounge.net> wrote: > > Am 24.02.2018 um 00:24 schrieb Roundcube: >> When trying to send an email from Roundcube I get: >> Connection failed: Failed to connect socket: fsockopen(): unable to connect to ssl://mail.covisp.net:587 > > it's as simple as port 587 is tls:// and not ssl:// > SSL versus STARTSSL You didn't see 3 lines down: >> If I change it to tls://mail.covisp.net I get: >> >> SMTP Error in /usr/local/www/roundcube/program/lib/Roundcube/rcube.php (1675): Authentication failure: STARTTLS failed (Code: ) -- Honesty may be the best policy, but it's important to remember that apparently, by elimination, dishonesty is the second-best policy.

1 0

failed to connect socket
by Roundcube 23 Feb '18

23 Feb '18

When trying to send an email from Roundcube I get: Connection failed: Failed to connect socket: fsockopen(): unable to connect to ssl://mail.covisp.net:587 Sending from any other mail client works on the submission port, so it is not a mail server configuration issue. If I change it to tls://mail.covisp.net I get: SMTP Error in /usr/local/www/roundcube/program/lib/Roundcube/rcube.php (1675): Authentication failure: STARTTLS failed (Code: ) $ openssl s_client -connect mail.covisp.net:587 -starttls smtp CONNECTED(00000003) depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3 verify error:num=2:unable to get issuer certificate issuer= O = Digital Signature Trust Co., CN = DST Root CA X3 --- Certificate chain 0 s:/CN=covisp.net i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 i:/O=Digital Signature Trust Co./CN=DST Root CA X3 --- Server certificate -----BEGIN CERTIFICATE----- MIIGXDCCBUSgAwIBAgISA8l2HqqZkKGc4w829muF4nnZMA0GCSqGSIb3DQEBCwUA MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xODAyMTMyMDIxMjZaFw0x ODA1MTQyMDIxMjZaMBUxEzARBgNVBAMTCmNvdmlzcC5uZXQwggIiMA0GCSqGSIb3 DQEBAQUAA4ICDwAwggIKAoICAQCjK35UbUb6YSMSzto4KgLPGv/h8jvkRMYuV3al iV28dXMEPUJ8vhGsLbXaMVKouZnrWMgJ7ws6TlzXNPuMnXuoplvhLMtXNKyAtyaI X0Hhhsb3yAfj2WI7FN15kedKnGFzNPDBuo8+g6q0yRgyj1erNj/K8xWwokpcpVrU Q5zsKnyqU9MHmmcyNFNFyCQ+quCfCLcK4T1klrQGKG564HQcj0hEXFZx6txj7irF Zul/0Ju2XdDaaF114+Fq2K/XCuRWfyWAGTSh8z7e/4CU0MDnnqIAVWcWfeeHLjTU 2hRd7TQEH0DWg1C95zHk0yLn2JJ/ffj0q/+RK8G8yjKogv351VNgfjbkoCxnluFS lYx5IPUdRvplEWOEMdtcvLf7J+S+e+Kf3u643SMKwblOboA9yqWyIrp32voxCWoF kVkO84E70U1yCZ4rbVcF9CwEySi/1la7Nm7Bnr24ByJT46TBlAKPEwUaj0VJeHi4 oHxXAZ3IYjdMgbT+DPWiz/jCrdahQrJC++HFaoqLd+dPGlla3Rn/FjigpABqJUJj YNLAXwP2hY2W1bRdJDjBG7978Uy8h2Ec8TTBjOSIHgQOoxFyuPg+kCinELPFxXmI +kxrtwpKelnxHpH5JdFDLIHN80TAqr5v2CnMA+9JSOjX6z6Yvpwom9LWJ9z34vpn X77OjQIDAQABo4ICbzCCAmswDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsG AQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRsPUj9me0H 2wqRgbnPiD2RIYvPUzAfBgNVHSMEGDAWgBSoSmpjBH3duubRObemRWXv86jsoTBv BggrBgEFBQcBAQRjMGEwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwLmludC14My5s ZXRzZW5jcnlwdC5vcmcwLwYIKwYBBQUHMAKGI2h0dHA6Ly9jZXJ0LmludC14My5s ZXRzZW5jcnlwdC5vcmcvMHoGA1UdEQRzMHGCCmNvdmlzcC5uZXSCD21haWwuY292 aXNwLm5ldIIVcGhwbXlhZG1pbi5jb3Zpc3AubmV0ghdwb3N0Zml4YWRtaW4uY292 aXNwLm5ldIISd2VibWFpbC5jb3Zpc3AubmV0gg53d3cuY292aXNwLm5ldDCB/gYD VR0gBIH2MIHzMAgGBmeBDAECATCB5gYLKwYBBAGC3xMBAQEwgdYwJgYIKwYBBQUH AgEWGmh0dHA6Ly9jcHMubGV0c2VuY3J5cHQub3JnMIGrBggrBgEFBQcCAjCBngyB m1RoaXMgQ2VydGlmaWNhdGUgbWF5IG9ubHkgYmUgcmVsaWVkIHVwb24gYnkgUmVs eWluZyBQYXJ0aWVzIGFuZCBvbmx5IGluIGFjY29yZGFuY2Ugd2l0aCB0aGUgQ2Vy dGlmaWNhdGUgUG9saWN5IGZvdW5kIGF0IGh0dHBzOi8vbGV0c2VuY3J5cHQub3Jn L3JlcG9zaXRvcnkvMA0GCSqGSIb3DQEBCwUAA4IBAQBONofC5LjFT2KSgkPjvuus shIprx/VYgOpfgFCvAmkQCbpLp8NmS8r4Dg9mMAqh/uhPgRV6BoGiuBR7eJRKH/W /sOY0AtysFxdslWb0hhCjaTXEGNz8c9z53xslNlU1ggp2k71FVzbFfhKnaDbYwem XXyquK2QKg5yPWxGmsfMSyNuP8q/qHCqBRiOWNxozSHw1k0Qr9cod1748hd/+HG4 nGBUiIQUPEJdWm3b+zvlr0PBKaOC4j3LSQpXj4FvHDy19DxxkmVNEE4+px5B0qJ9 WeXyPb2Hop4Ly6o9UKaynICgYEC2CXrRv7GZ/oGesdpF7k9mEA5Tt1nbW+rp+exF -----END CERTIFICATE----- subject=/CN=covisp.net issuer=/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 --- No client certificate CA names sent Peer signing digest: SHA512 Server Temp Key: ECDH, P-256, 256 bits --- SSL handshake has read 3783 bytes and written 468 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 4096 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: 41E4C231E6E193E6DAC1CFBA6C890132BD10B24467F056BEBB68BEE0D5D2E275 Session-ID-ctx: Master-Key: E40F4A64F059BE52089D0F1F5CCF7E0640C870C618FA4FB97337AF1ED43F4F3A325610088EC67BCB2C5113E5E7CC3D9B Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1519428085 Timeout : 300 (sec) Verify return code: 2 (unable to get issuer certificate) --- 250 DSN -- ɹןʇnqן lbutler(a)covisp.net

1 0

Request security check failed
by Jorge Bastos 23 Feb '18

23 Feb '18

Howdy, I've been seen this info in the logs, and my question is, is this some sort of hack attempt, or should not care about? Jorge, == Feb 22 19:36:52 fastweb roundcube: <h9lj7u9d> PHP Error: Request security check failed (GET /webmail/?_task=logout&_token=4gqJNrvLh3TYhjN4dYxEcV8pba8oT6Q8)

1 1

Export mail folders and messages
by Wendy Quihampton 21 Feb '18

21 Feb '18

Hi Is it possible to export mail folders and messages? Wendy Quihampton Project Manager, Digital Access to Collections E: wendy.quihampton(a)museumsaustralia.org.au M: 0428 587 737 Museums Galleries Australia GLAM Peak www.digitalcollections.org.au

1 0

Example for manage sieve of: /etc/dovecot/sieve/global
by Jorge Bastos 13 Feb '18

13 Feb '18

Howdy, Where could i see an example of whats inside or what would be possible to add there, for the default that comes in manage sieve plugin config.php "/etc/dovecot/sieve/global" Thanks.

1 0

Permissions of enigma/home
by Andreas Meyer 13 Feb '18

13 Feb '18

Hello! What are the right permissions for content of plugins/enigma/home/user(a)domain.org? At the moment it looks like this: drwx------ 2 root root 4096 30. Mai 2016 private-keys-v1.d -rw------- 1 root root 10057 7. Apr 2017 pubring.gpg -rw------- 1 root root 7548 7. Apr 2017 pubring.gpg~ -rw------- 1 root root 600 7. Apr 2017 random_seed -rw------- 1 root root 2685 7. Apr 2017 secring.gpg But that's not right. What's best? Kind regards Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

2 1

Re: [RCU] Security issue (possible?) (was: RE: Unknown user in users table, very odd, possible security hole)
by A.L.E.C 11 Feb '18

11 Feb '18

On 02/09/2018 09:28 PM, Jorge Bastos wrote: > Well yes, but now i'm thinking, i have the imap server set to be dynamic > it's filled with: > > mail. + domain.tld > > ok this option in Roundcube is grrreeeaaattt, but I think it makes people > use my server for webmail! Damn! > > How would I tell Roundcube, to connect just to my ip's? > I could do this via iptables but is some shared hosting user wants to > connect to any imap server he would be blocked You have a few options to deal with this default_host username_domain username_domain_forced login_username_filter trusted_host_patterns How to use them will depend on what you want to achieve and your environment. You can always create a plugin that checks the host before connecting to it. -- Aleksander 'A.L.E.C' Machniak Kolab Groupware Developer [http://kolab.org] Roundcube Webmail Developer [http://roundcube.net] ---------------------------------------------------- PGP: 19359DC1 # Blog: https://kolabian.wordpress.com

2 1

LDAP address book - problem with groups
by Franta Hanzlík 11 Feb '18

11 Feb '18

Hi, new to Roundcube, I have still some confusion about configuring the LDAP address book. Please, is somewhere a little detailed description of the configuration scenarios and individual options? Now I have something as this (found somewhere on the net): $config['ldap_public']['public'] = array( 'name' => 'Public LDAP Addressbook', 'hosts' => array('ldap.mydomain'), 'base_dn' => 'o=spse', 'bind_dn' => 'cn=binduser,o=myorg', 'bind_pass' => 'binduseracces', 'filter' => '(&(objectClass=inetOrgPerson)(cn=z*))', 'sort' => 'sn', 'global_search' => true, 'fuzzy_search' => true, 'groups' => array( 'base_dn' => '', 'mail' => '{Mail-Address}(a)mydomain.com', 'filter' => '(&(objectClass=groupOfNames)(Mail-Address=*))', 'object_classes' => array("top", "groupOfNames"), 'class_member_attr' => array( 'groupofnames' => 'member', 'groupofuniquenames' => 'uniquemember' ), ), 'name_field' => 'uid', 'email_field' => 'mail', 'surname_field' => 'sn', 'firstname_field' => 'givenName', 'scope' => 'sub' ); and although as I understand the description for individual people, I do not even understand the description of groups - whole this block: 'groups' => array( 'base_dn' => '', 'mail' => '{Mail-Address}(a)mydomain.com', 'filter' => '(&(objectClass=groupOfNames)(Mail-Address=*))', 'object_classes' => array("top", "groupOfNames"), 'class_member_attr' => array( 'groupofnames' => 'member', 'groupofuniquenames' => 'uniquemember' ), ), - why it is included just where it is? - what is meant by: 'object_classes' => array("top", "groupOfNames"), ? what is block: 'class_member_attr' => array( 'groupofnames' => 'member', 'groupofuniquenames' => 'uniquemember' ), In spite of all the confusion, RC puts something out. But what bothers me and I need to have it differently: - when in new mail I write recipient address, autocompletion offers me the required group. But when I click on it, in the address bar appears no single address (groupname@mydomain), but mail addresses of all group members! What with this? - in address book menu, I want to display group names (as is now), but not their members (or at least not to all RC users). Is this possible somehow? I'm trying Roundcube version 1.3.4, LDAP DB is some commercial one with schema roughly corresponding with Openldap core, and groups are defined as: dn: cn=_groupName_,ou=Groups,o=myorg Mail-Address: _groupName_ objectClass: groupOfNames objectClass: Top objectClass: Mail-Group member: cn=_user1_,ou=XX,o=myorg member: cn=_user2_,ou=YY,o=myorg ... cn: _groupName_ (there isn't complete mail address - only part before '@'. All groups in addressbook are in one domain) Thanks in advance for your help! Franta Hanzlik

2 2

Security issue (possible?) (was: RE: Unknown user in users table, very odd, possible security hole)
by Jorge Bastos 09 Feb '18

09 Feb '18

ALEC!!!!!!! There's some security problem in RC I believe! Check this: Feb 9 01:46:44 fastweb roundcube: <ibj96bvb> Successful login for donny(a)adhigunaputera.com (ID: 100412) from 110.136.11.0 in session ibj96bvbj5akqlt5slpc47ikfb This user doesn't belong to any of the IMAP accounts, how was he able to login? After the login, there's some login failed lines: Feb 9 02:47:27 fastweb roundcube: <ibj96bvb> IMAP Error: Login failed for donny(a)adhigunaputera.com from 110.136.11.0. Empty startup greeting (mail.adhigunaputera.com:143) in /home/hosting/dhosting.pt/webmail/program/lib/Roundcube/rcube_imap.php on line 196 (POST /webmail/?_task=mail&_action=refresh) Feb 9 02:48:37 fastweb roundcube: <ibj96bvb> IMAP Error: Login failed for donny(a)adhigunaputera.com from 110.136.11.0. Empty startup greeting (mail.adhigunaputera.com:143) in /home/hosting/dhosting.pt/webmail/program/lib/Roundcube/rcube_imap.php on line 196 (POST /webmail/?_task=mail&_action=refresh) Feb 9 02:49:47 fastweb roundcube: <ibj96bvb> IMAP Error: Login failed for donny(a)adhigunaputera.com from 110.136.11.0. Empty startup greeting (mail.adhigunaputera.com:143) in /home/hosting/dhosting.pt/webmail/program/lib/Roundcube/rcube_imap.php on line 196 (POST /webmail/?_task=mail&_action=refresh (funny the IP is the network IP) What's the best place to move forward with investigation with this issue, here or dev list? Could you assist me on this? Thank you in advanced, From: users-bounces(a)lists.roundcube.net [mailto:users-bounces@lists.roundcube.net] On Behalf Of Hannu Hirvonen Sent: 8 de fevereiro de 2018 20:43 To: users(a)lists.roundcube.net Subject: Re: [RCU] Unknown user in users table, very odd, possible security hole On 08.02.2018 22:34, Jorge Bastos wrote: Not in there but you made me remind about: // Log successful/failed logins to <log_dir>/userlogins or to syslog That's why I said "something like ...", might have been a bit clearer, of course :-) -- Hannu Hirvonen (hh(a)uwasa.fi <mailto:hh@uwasa.fi> , http://www.uwasa.fi/~hh/) Computer Centre, University of Vaasa, BOX 700, FI-65101 VAASA, Finland

2 3

Re: [RCU] Unknown user in users table, very odd, possible security hole
by Hannu Hirvonen 08 Feb '18

08 Feb '18

On 08.02.2018 22:34, Jorge Bastos wrote: > > Not in there but you made me remind about: > > // Log successful/failed logins to <log_dir>/userlogins or to syslog > That's why I said "something like ...", might have been a bit clearer, of course :-) -- Hannu Hirvonen (hh(a)uwasa.fi, http://www.uwasa.fi/~hh/) Computer Centre, University of Vaasa, BOX 700, FI-65101 VAASA, Finland

1 0

Re: [RCU] Unknown user in users table, very odd, possible security hole
by Hannu Hirvonen 08 Feb '18

08 Feb '18

On 08.02.2018 22:06, Jorge Bastos wrote: > > That’s what i would like to do, but where would i find that information? > > In the users table isn’t there, or I’m not searching in the correct place. > Something like */var/log/roundcubemail/userlogins* perhaps? -- Hannu Hirvonen (hh(a)uwasa.fi, http://www.uwasa.fi/~hh/) Computer Centre, University of Vaasa, BOX 700, FI-65101 VAASA, Finland

2 1

Unknown user in users table, very odd, possible security hole
by Jorge Bastos 08 Feb '18

08 Feb '18

Howdy, I have a verrryyyyy odd thing happening. I have an user, unknown, that is in my users table, for a domain that isn't mine, and never was. This records keep's having last_login fields updated, so someway he's being able to login right? Odd to see that the field after the datetime fields (that is the failed_login_count) is zero, Is there any plugin or so to records the IP from which the logins are made? Where to search for this possible breach? Regards,

2 2

My roundcube email
by Sharon Canovali 07 Feb '18

07 Feb '18

Hi! I'm wondering if anyone can help me get my email straightened out. I've had challenges from the start and greatly fear I've lost business because it's the address on my business cards, but I am unable to receive ANY emails. The account is so clogged emails won't even load. I can't even clean it up, or do anything. 😔 I appreciate any help you can give. Thank you, so much.

4 5

Invalid request! No data was saved. after leaving browser window open
by Karol Augustin 31 Jan '18

31 Jan '18

Hi, I have a problem when user logs out from RC and leaves window open for some time (login screen after logout). When they want to log back they always get "Invalid request! No data was saved." error. I have reproduced it myself and I don't know why it is happening. I have noticed that the same error happens when I remove roundcube_sessid cookie from the browser. This cookie is marked to be deleted when the browser session ends. Is that possible that corresponding session ID is removed from the database when the window is still open and on re-login attempt the still existing cookie causes the error? There is nothing useful in the logs when error happens: Jan 31 09:19:02 mail roundcube: <lm76g1l0> Failed login for karol(a)augustin.pl from xx.xx.xx.xx in session <sessid> (error: 1) The "wrong password" log is the same with "error: 0" at the end. I am using Apache2 with php7.0. Thanks, Karol -- Karol Augustin karol(a)augustin.pl http://karolaugustin.pl/ +353 85 775 5312

1 0

IP in users table
by Jorge Bastos 27 Jan '18

27 Jan '18

Howdy, Is it possible, or is there any known plugin to add the login IP to the users table? Thanks in advanced,

1 0

Records in users table
by Jorge Bastos 27 Jan '18

27 Jan '18

Howdy, I'm curious about something! Is it supposed to have records in the users table, for failed attempts? I have a few record for login's that don't belong to me (they're spam attempts or so, not worried about that. Jorge,

1 0

password
by Kaseem Ismail 25 Jan '18

25 Jan '18

2 1

Roundcube Webmail Update 1.3.4 released
by Thomas Bruederli 14 Jan '18

14 Jan '18

Dear subscribers We proudly announce the next service release to update the stable version 1.3. It contains fixes to several bugs reported by our dear community members and makes Roundcube now fully compatible with PHP 7.2. See the full changelog in the release notes [1] on our Github download page. This release is considered stable and we recommend to update all productive installations of Roundcube with this version. Download it from https://roundcube.net/download. And as usual: please do backup your data before updating! New: starting with version 1.3.3 we also publish Roundcube releases as Docker images. The images are still considered BETA and your feedback with regards to setup, configuration and documentation is much appreciated. Best, Alec & Thomas [1] https://github.com/roundcube/roundcubemail/releases/tag/1.3.4

1 0

DKIM roundcube-1.3.3-1.remi.el6
by Eric Broch 12 Jan '18

12 Jan '18

Hello list, I'm using roundcube-1.3.3-1.remi.el6. I've set up DKIM in my SMTP server. The messages are being signed but are failing DKIM tests when I send in plain text from roundcubemail interface, but when I send the messages in html format from roundcubemail the messages pass DKIM tests. I'm testing by sending to a gmail account and port25.com, by the way. In Thuderbird and Squirrelmail the messages do not fail. If also tested my DKIM with keys with the opendkim package 'opendkim-testkey' and they pass. The the email headers have slight differences between those sent by Squirrelmail/Thunderbird and Roundcube in plain text. Any help would be appreciated in resolving this...maybe a configuration setting? -- Eric Broch White Horse Technical Consulting (WHTC)

1 0

"Must issue a STARTTLS command first"
by Jonathan Nichols 02 Jan '18

02 Jan '18

This might be a really simple issue, but my searches haven’t come up with a solution yet. (only one thread where a guy said he solved it but never elaborated.) Roundcube gives an error of "SMTP Error (250): Authentication failed.” and the log has "Must issue a STARTTLS command first." PHP 5.6.4 Postfix 2.11.3 Roundcube 1.3.3 Things used to work just fine but it’s been a while since I’ve used roundcube to send any emails, so i haven’t noticed until now.. No self-signed certificate. Thunderbird/Apple Mail work ok. config.inc.php has: $config['default_host'] = 'tls://%n’; #I’ve tried ‘tls://pile.pbp.net' as well $config['smtp_port'] = 587; $config['smtp_user'] = '%u'; $config['smtp_pass'] = '%p’; smtp_debug shows: [31-Dec-2017 14:13:15 -0600]: <jlfk3bmj> Recv: 220 pile.pbp.net ESMTP Postfix (Ubuntu) [31-Dec-2017 14:13:15 -0600]: <jlfk3bmj> Send: EHLO pile.pbp.net [31-Dec-2017 14:13:15 -0600]: <jlfk3bmj> Recv: 250-pile.pbp.net [31-Dec-2017 14:13:15 -0600]: <jlfk3bmj> Recv: 250-PIPELINING [31-Dec-2017 14:13:15 -0600]: <jlfk3bmj> Recv: 250-SIZE 30480000 [31-Dec-2017 14:13:15 -0600]: <jlfk3bmj> Recv: 250-ETRN [31-Dec-2017 14:13:15 -0600]: <jlfk3bmj> Recv: 250-STARTTLS [31-Dec-2017 14:13:15 -0600]: <jlfk3bmj> Recv: 250-ENHANCEDSTATUSCODES [31-Dec-2017 14:13:15 -0600]: <jlfk3bmj> Recv: 250-8BITMIME [31-Dec-2017 14:13:15 -0600]: <jlfk3bmj> Recv: 250 DSN [31-Dec-2017 14:13:15 -0600]: <jlfk3bmj> Send: RSET [31-Dec-2017 14:13:15 -0600]: <jlfk3bmj> Recv: 530 5.7.0 Must issue a STARTTLS command first [31-Dec-2017 14:13:15 -0600]: <jlfk3bmj> Send: QUIT [31-Dec-2017 14:13:15 -0600]: <jlfk3bmj> Recv: 221 2.0.0 Bye Anything else that I should check? it is a slightly older ubuntu release (15.04) at this point. I’m looking at moving webmail to another machine with a newer install. Thank you! — jonathan

2 2

Timeout on login
by Roundcube 27 Dec '17

27 Dec '17

FreeBSD 11.1, roundcube 1.3.3, php70. When I try to login to any account I get: [27-Dec-2017 06:41:47 -0700]: <c7cd1119> IMAP Error: Login failed for user(a)example.com against mail.covisp.net from xx.xx.xx.xx. Empty startup greeting (mail.covisp.net:993) in) in errors.log I changed $config['default_host'] = 'tls://mail.covisp.net/'; to $config['default_host'] = 'imaps://mail.covisp.net/'; and now get "Could not connect to ssl://mail.covisp.net:993" Do I *have* to use localhost if the mail server is the same machine? I wanted the configuration to be the same across multiple machines, so I was using the FQDN instead.

1 0

Mark messages to be deleted instead of delete them
by Jorge Bastos 26 Dec '17

26 Dec '17

Hi, Is it possible to configure RC to behave like this: * Mark messages to be deleted, but don't move them to trash? Like outlook. Jorge,

2 2

search
by mick crane 25 Dec '17

25 Dec '17

hello. search feature ( 1.3.1 ) searches in the open directory is there somewhere an option to search in the whole INBOX ? Merry Christmas mick crane -- Key ID 4BFEBB31

2 2

Plugin new_user_identity is not filling field in SQL
by Spickiy Nikita 25 Dec '17

25 Dec '17

Hi, i try setting plugin new_user_identity. I adding public address book (ldap), settings for plugin. I analyzed log slapd server and made sure that plugin make request when i login to mail page. But fields in Identiies is empty. I can not understand in what trouble. Please, need help me. Rgds, Nikita Spickiy Skype - n.spickiy(a)outlook.com Asia/Novosibirsk, UTC +7

1 0

Need help with OOO plug-in
by Celso Maiolo 18 Dec '17

18 Dec '17

Hello Roundcube experts- wondering if a kind soul would offer some assistance in setting up a OOO plugin for a functioning Roundcube setup on a MacOS server? The basic setup is working fine. I’ve chosen a specific plugin but it may not be the best one? Also, for some reason when I perform a php -v the mcrypt module complains of a build mismatch? I reinstalled until blue in the face but no joy. Really appreciate and assistance and guidance. Thank you Celso Sent from my iPad

1 0

Roundcube 1.3 and _SERVER['HTTPS']
by Webert de Souza Lima 18 Dec '17

18 Dec '17

Hello everyone, I have recently upgraded Roundcube from release-1.2 to release-1.3. Roundcube is running behind HA-Proxy with SSL-Termination, which means that the traffic is encrypted between the client and haproxy but not between haproxy and roundcube(served by nginx). It seems that after the upgrade, the variable $_SERVER['HTTPS'] is not being set to 'on', and some plugins that use this variable are serving resources over http, which causes the browser to complain about Mixed Content and connection not fully secure. Not all domains are set to redirect to SSL port, so I can't force https, but the ones who use it are set up in nginx like this: server { listen 80; server_name webmail.domain_name; return 301 https://$server_name/; } server { listen 443; root /var/www; index index.php; server_name webmail.domain_name; access_log off; location / { try_files $uri $uri/ =404; } location ~ .php$ { root /var/www; fastcgi_pass php; fastcgi_read_timeout 120; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; } } the port 443 here is just a different port but traffic is not encrypted because the HA-Proxy does the encryption with the client. Any suggestions to fix this? Thanks! Regards, Webert Lima DevOps Engineer at MAV Tecnologia *Belo Horizonte - Brasil* *IRC NICK - WebertRLZ*

2 3

Login failure
by ＠lbutlr 17 Dec '17

17 Dec '17

I am trying to setup roundcube again and am having some issues. Empty startup greeting (mail.covisp.net:993) in /usr/local/www/roundcube/program/lib/Roundcube/rcube_imap.php on line 196 (POST /webmail.php?_task=login&_action=login) But the server in question works fine on other clients on port 993 (in fact, I am connecting to it right now in this client). config.inc.php: <?php $config['db_dsnw'] = 'mysql://rcuser:password@localhost/roundcube'; $config['enable_installer'] = false; $config['default_host'] = 'tls://mail.covisp.net/'; $config['default_port'] = 993; $config['imap_auth_type'] = 'PLAIN'; $config['imap_auth_type'] = null; $config['smtp_server'] = 'tls://mail.covisp.net/'; $config['smtp_port'] = 587; $config['smtp_user'] = '%u'; $config['smtp_pass'] = '%p'; $config['support_url'] = 'http://help.covisp.net'; $config['des_key'] = 'd9759cf7d0eb3102aeb30898'; $config['product_name'] = 'C O V I S P'; $config['plugins'] = array('archive', 'emoticons', 'help', 'hide_blockquote', 'identity_select', 'markasjunk', 'logon_page'); $config['spellcheck_engine'] = 'pspell'; $config['debug_level'] = 13; $config['sql_debug'] = true; $config['imap_debug'] = true; $config['smtp_debug'] = true; If it matters, I am not accessing the webmail via index.php, but rather have named that file webmail.php for testing purposes. -- Apple broke AppleScripting signatures in Mail.app, so no random signatures.

2 1

Roundcube with php7.2
by ＠lbutlr 14 Dec '17

14 Dec '17

I see that this is fixed in the Changelog on GitHub, but is there a patch for the current version in ports? (roundcube-1.3.3,1) Deprecated: idn_to_ascii(): INTL_IDNA_VARIANT_2003 is deprecated in /usr/local/www/roundcube/program/lib/Roundcube/rcube_utils.php on line 880 -- Apple broke AppleScripting signatures in Mail.app, so no random signatures.

1 0

Re: [RCU] Cron files
by Jorge Bastos 11 Dec '17

11 Dec '17

Thank you, That's what I had in mind. Daly would be fine for me have a few thousands but nothing the machine cannot handle, machines are meant to work :p Thank you all for the tips, -----Original Message----- From: Reindl Harald [mailto:h.reindl@thelounge.net] Sent: 11 de dezembro de 2017 10:21 To: Roundcube Users mailing list <users(a)lists.roundcube.net>; Jorge Bastos <mysql.jorge(a)decimal.pt> Subject: Re: [RCU] Cron files Am 11.12.2017 um 11:04 schrieb Jorge Bastos: > Hi Thomas, > > Thank you, so i'll add gc and cleandb, whould this be running daily? surely if it would be destructive once per week bould be the same problem as per day and if a simple cleanup job onece per day is a performance problem you have bigger ones > -----Original Message----- > From: users-bounces(a)lists.roundcube.net > [mailto:users-bounces@lists.roundcube.net] On Behalf Of Thomas > Bruederli > Sent: 10 de dezembro de 2017 14:56 > To: Roundcube Users mailing list <users(a)lists.roundcube.net> > Subject: Re: [RCU] Cron files > > On Thu, Dec 7, 2017 at 4:29 PM, Ulli Heist > <Ulli.Rainer.Heist(a)t-online.de> > wrote: >> Hello, >> >> sometimes I'm doing manuel: >> >> $SQL = "SELECT * FROM `contacts` WHERE `del` = 1 AND >> DATE_ADD(`changed`,INTERVAL 45 DAY) < NOW() "; >> >> ... > > We have `bin/cleandb.sh` in Roundcube that does exactly this ;-) > > This and the already mentioned `bin/gc.sh` should do it for periodic > clean-ups

1 0

Cron files
by Jorge Bastos 11 Dec '17

11 Dec '17

Hi, Which cron job's should be added for a good maintenance of RC? gc.sh and what else? Thanks,

3 3

Inbox is only 42 mb
by Toni Wallen 08 Dec '17

08 Dec '17

My inbox folder is only 42mb and will not allow more than 1 day of emails. How do you get the folders larger in size, the email box is 10 GB. Thank you, Toni Wallen, Office Manager Toni Wallen/ Office Manager toni(a)alltechmachining.com All-Tech Machining, Inc. Office: 251-649-4009/ Fax: 251-649-4061 13475 Laco Cooper Road, Wilmer, AL 36587 http://alltechmachining.com --- This email has been checked for viruses by AVG. http://www.avg.com

4 7

PHP 7.2 support
by Philip Iezzi 07 Dec '17

07 Dec '17

Hi there, How does PHP 7.2 support come along? Can Roundcube 1.3.3 already be used in production on PHP 7.2. So far, on my PHP 7.2.0 test instances, I didn't find a single glitch. Cheers, Philip

2 2

Re: [RCU] PHP 7.2 support
by Philip Iezzi 07 Dec '17

07 Dec '17

On 7 Dec 2017, at 01:29, Reindl Harald <h.reindl(a)thelounge.net> wrote: > > why should any sane code running on 7.1 without warnings have a problem with 7.2 What a great answer! Because http://php.net/manual/en/migration72.deprecated.php (e.g. each() function deprecation) and http://php.net/manual/en/migration72.incompatible.php (e.g. E_WARNING on count()) - little things that even projects with an almost perfect code base stumble upon. The world is not perfect! Remember my wise words.

1 0

Re: [RCU] HP Warning: touch(): Unable to create file /var/sqlite/roundcube/roundcube.db because No such file or directory in /var/www/webmail12.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php on line 38
by Sophie Loewenthal 07 Dec '17

07 Dec '17

And to prove you wrong :) root@mx10 /var/www # stat /var/www/webmail12.ex.co.uk <http://webmail12.ex.co.uk/> stat: cannot stat '/var/www/webmail12.ex.co.uk <http://webmail12.ex.co.uk/>': No such file or directory root@mx10 /var/www # stat /var/www/webmail12.ex.co.uk/program <http://webmail12.ex.co.uk/program> stat: cannot stat '/var/www/webmail12.ex.co.uk/program': <http://webmail12.ex.co.uk/program':> No such file or directory root@mx10 /var/www # stat /var/www/webmail12.ex.co.uk/program/lib <http://webmail12.ex.co.uk/program/lib> stat: cannot stat '/var/www/webmail12.ex.co.uk/program/lib': <http://webmail12.ex.co.uk/program/lib':> No such file or directory root@mx10 /var/www # stat /var/www/webmail12.ex.co.uk/program/lib/Roundcube/ <http://webmail12.ex.co.uk/program/lib/Roundcube/> stat: cannot stat '/var/www/webmail12.ex.co.uk/program/lib/Roundcube/': <http://webmail12.ex.co.uk/program/lib/Roundcube/':> No such file or directory root@mx10 /var/www # stat /var/www/webmail12.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php <http://webmail12.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php> stat: cannot stat '/var/www/webmail12.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php': <http://webmail12.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php':> No such file or directory > On 7 Dec 2017, at 18:58, Reindl Harald <h.reindl(a)thelounge.net <mailto:h.reindl@thelounge.net>> wrote: > > > > Am 07.12.2017 um 18:56 schrieb Reindl Harald: >> Am 07.12.2017 um 18:54 schrieb Sophie Loewenthal: >>> Sorry this was written strangely. I meant: >>> >>> This was my thought, except the vhosts it complained of and the directory does not exist : /var/www/webmail12.ex.co.uk <http://webmail12.ex.co.uk/> <http://webmail12.ex.co.uk <http://webmail12.ex.co.uk/>> and was changed to /var/www/webmail10.ex.co.uk <http://webmail10.ex.co.uk/> <http://webmail10.ex.co.uk <http://webmail10.ex.co.uk/>> in the vhosts and the actual directory >> when PHP reports a error in the script /var/www/webmail12.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php <http://webmail12.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php> it does exist - period >> at the moment PHP triggers that error that script is running > > and to prove the opposite provide the output of > > stat /var/www/webmail12.ex.co.uk <http://webmail12.ex.co.uk/> > stat /var/www/webmail12.ex.co.uk/program <http://webmail12.ex.co.uk/program> > stat /var/www/webmail12.ex.co.uk/program/lib <http://webmail12.ex.co.uk/program/lib> > stat /var/www/webmail12.ex.co.uk/program/lib/Roundcube/ <http://webmail12.ex.co.uk/program/lib/Roundcube/> > stat /var/www/webmail12.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php <http://webmail12.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php> > > i bet everything none of them return any error

1 0

Re: [RCU] HP Warning: touch(): Unable to create file /var/sqlite/roundcube/roundcube.db because No such file or directory in /var/www/webmail12.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php on line 38
by Sophie Loewenthal 07 Dec '17

07 Dec '17

This was my thought, except the vhosts it complained of and the directory does not exist : /var/www/webmail12.ex.co.uk -- On December 7, 2017 6:37:37 PM CET, Reindl Harald <h.reindl(a)thelounge.net> wrote: > > >Am 07.12.2017 um 18:25 schrieb Sophie Loewenthal: >> Hi, >> >> I just migrated Roundcube install to a new server and it cannot find >the >> dB. The issue is that this file : >> >> webmail10.ex.co.uk/logs/errors:[29-Nov-2017 >> <http://webmail10.ex.co.uk/logs/errors:[29-Nov-2017> 12:13:54 >> Europe/Brussels] PHP Warning: touch(): Unable to create file >> /var/sqlite/roundcube/roundcube.db because No such file or directory >in >> /var/www/webmail12.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php > >> <http://webmail12.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php> >on >> line 38 >> >> /var/www/webmail12.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php > >> <http://webmail12.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php> >> should be : >> >/var/www/webmail1*0*.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php > >> <http://webmail10.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php> >> >> Where in roundcube is this coded? I’ve grepped the whole directory >can >> did not find any reference except in the config file, which was >changed > >nowhere - that's pretty sure the vhost config of your webserver > >as you can see the touch was called at >/var/www/webmail12.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php >and so /var/www/webmail12.ex.co.uk is the actice vhost > >that /var/sqlite/roundcube/ does not exist is a completly other problem > >p.s.: the horrible quting is a result of send HTML mail to lists

1 1

adaptive design
by Meaulnes Legler ＠ roundcube 07 Dec '17

07 Dec '17

hello all I have users that complain that the webmailer doesn't display correctly on their smartphones when using FLINT's Larry skin interface. They cannot reduce the display size nor change the width of the left folders column. Is there a skin interface that uses adaptive design? How can one install it? Thank you and best regards _~_ '¿') `-´ Meaulnes Legler Zurich, Switzerland +41\0 44 260 16 60

5 5

HP Warning: touch(): Unable to create file /var/sqlite/roundcube/roundcube.db because No such file or directory in /var/www/webmail12.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php on line 38
by Sophie Loewenthal 07 Dec '17

07 Dec '17

Hi, I just migrated Roundcube install to a new server and it cannot find the dB. The issue is that this file : webmail10.ex.co.uk/logs/errors:[29-Nov-2017 12:13:54 Europe/Brussels] PHP Warning: touch(): Unable to create file /var/sqlite/roundcube/roundcube.db because No such file or directory in /var/www/webmail12.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php on line 38 /var/www/webmail12.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php <http://webmail12.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php> should be : /var/www/webmail10.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php <http://webmail10.ex.co.uk/program/lib/Roundcube/rcube_db_sqlite.php> Where in roundcube is this coded? I’ve grepped the whole directory can did not find any reference except in the config file, which was changed. Regards, Sophie

1 0

mailsploit
by Maarten 07 Dec '17

07 Dec '17

Hello, Is roundcube going to get a patch for mailsploit? https://www.mailsploit.com/ I tried the demo and it seems that roundcube is vulnurable for this: https://www.mailsploit.com/index#demo Incoming mail can be shown is if were from some domein which it is not from.

2 2

Account locked due to multiple failed logins
by Jorge Bastos 24 Nov '17

24 Nov '17

Hi, I have an account locked due to multiple failed logins, it was with the default of 3 ($config['login_rate_limit'] = 3;) But, where do I unlock the account now? Thanks in advanced,

1 1

Re: [RCU] Email Transfer
by Nicholas Graham 22 Nov '17

22 Nov '17

The email service that they are using is Roundcube and it is the default webmail service on bluest. I just want to make sure that their emails won’t go down when that transfer happens since I don’t have any experience in it. Nick > On Nov 22, 2017, at 9:48 AM, Reindl Harald <h.reindl(a)thelounge.net> wrote: > > > > Am 22.11.2017 um 15:34 schrieb Nicholas Graham: >> I am trying to host a domain on Bluehost but when I transferred the domain over the emails stopped working on their normal servers. I was told by bluest support that once transferred over that the email would work through their webmail portal can anyone confirm this? > > what has this to do with Roundcube?

2 2

Email Transfer
by Nicholas Graham 22 Nov '17

22 Nov '17

I am trying to host a domain on Bluehost but when I transferred the domain over the emails stopped working on their normal servers. I was told by bluest support that once transferred over that the email would work through their webmail portal can anyone confirm this? Nick

1 0

Problem with session_lifetime
by sws001 11 Nov '17

11 Nov '17

Hello, I have a problem with the Roundcube 1.2.3 under Debian 9. In my config I set: $config['log_session'] = true; and $config['session_lifetime'] = 20; Unfortunately that doesn't work. Roundcube don't close session at all. This big problem for me. Except for this feature everything works fine. Very thanks for all suggestions. Mrok

2 3

after upgrade; still can't index contacts
by Fabian A. Santiago 09 Nov '17

09 Nov '17

once again, after up'ing from 1.3.1 to 1.3.2, i still receive: ERROR: SQLSTATE[HY000] [1045] Access denied for user 'roundcube'@'localhost' (using password: NO)Error 500: Error connecting to database: SQLSTATE[HY000] [1045] Access denied for user 'roundcube'@'localhost' (using password: NO) after trying to run indexcontacts script from cli: from within the downloaded package folder: ./bin/indexcontacts.sh (while logged in as root / or with sudo) this always happens on each upgrade attempt and still can't make heads or tails of it. anyone have any ideas or has this been mentioned and i'm simply forgetting the fix / corrective action? Thanks everyone. btw: centos 7.4 mariadb 10.2.9 apache 2.4.6 -- -- Thanks, Fabian S. OpenPGP: 3C3FA072ACCB7AC5DB0F723455502B0EEB9070FC

1 1

Security updates 1.3.3, 1.2.7 and 1.1.10 released
by Thomas Bruederli 08 Nov '17

08 Nov '17

Dear subscribers We just published updates to all stable versions from 1.1.x onwards delivering fixes for a recently discovered file disclosure vulnerability in Roundcube Webmail. Apparently this zero-day exploit is already being used by hackers to read Roundcube’s configuration files. It requires a valid username/password as the exploit only works with a valid session. More details will be published soon under CVE-2017-16651. The Roundcube series 1.0.x is not affected by this vulnerability but we nevertheless back-ported the fix in order to protect from yet unknown exploits. See the full changelog for the according version in the release notes on the Github download pages: https://github.com/roundcube/roundcubemail/releases/tag/1.3.3 https://github.com/roundcube/roundcubemail/releases/tag/1.2.7 https://github.com/roundcube/roundcubemail/releases/tag/1.1.10 https://github.com/roundcube/roundcubemail/releases/tag/1.0.12 We strongly recommend to update all productive installations of Roundcube with either one of these versions. In order to check whether your Roundcube installation has been compromised check the access logs for requests like ?_task=settings&_action=upload-display&_from=timezone As mentioned above, the file disclosure only works for authenticated users and by finding such requests in the logs you should also be able to identify the account used for this unauthorized access. For mitigation we recommend to change the all credentials to external services like database or LDAP address books and preferably also the 'des_key' option in your config. Kind regards Alec & Thomas

1 0

managesieve plugin
by mick crane 04 Nov '17

04 Nov '17

hello, I have roundcube dovecot installation for one user, me, on debian jessie. I try to use the managesieve plugin installed dovecot-sieve and dovecot-managesieved with apt and activated roundcube plugin. there is a file ~/sieve/managesieve.sieve which has rules in it and there are no complaints in the webpage of roundcube but messages are not moved to folders. Can somebody point me to a resource explaining what to put in dovecot configuration files to make it work ? cheers mick -- Key ID 4BFEBB31

2 7

Roundcube Webmail Update 1.3.2 released
by Thomas Bruederli 31 Oct '17

31 Oct '17

Dear subscribers We proudly announce the second service release to update the stable version 1.3. It contains fixes to several bugs reported by you, our dear community members as well as translation updates synchronized from Transifex. We also changed the wording for the setting that controls the time after which an opened message is marked as read. This was previously only affecting messages being viewed in the preview panel but now applies to all means of opening a message. That change came with 1.3.0 an apparently confused many users. Some translation work is still needed here. See the full changelog in the release notes [1] on our Github download page. This release is considered stable and we recommend to update all productive installations of Roundcube with this version. Download it from https://roundcube.net/download. And as usual: please do backup your data before updating! Best, Alec & Thomas [1] https://github.com/roundcube/roundcubemail/releases/tag/1.3.2

1 0

Addressbook and QRCode issue in Roundcube ver 1.3.1
by Jorge 18 Oct '17

18 Oct '17

Hi, I have installed Roundcube version 1.3.1 and I have a problem when in addressbook I clicks on QR Code button. When I clicks on QR Code button, the QR Code image is not shown and in log file I have a lot of lines saying: PHP Warning: str_repeat(): Second argument has to be greater than or equal to 0 in (RC dir)\vendor\endroid\qrcode\src\QrCode.php on line 1230 Are there anybody that have same problem? It is posible to solve this problem? I ran RC under Windows with PHP 5.6.4 TIA. Jorge Colaccini --- El software de antivirus Avast ha analizado este correo electrónico en busca de virus. https://www.avast.com/antivirus

2 2

Issue with filters plugin
by absolutely_free＠libero.it 17 Oct '17

17 Oct '17

Hi, I am using RC 1.3.1 (I just upgraded from 1.1.9). After upgrade it seems plugin "filters" (2.1.6) is not working anymore. Every time I get error "field contains cannot be empty", even with a non-empty value, of course. Any suggestion? Thank you very much!

3 3

RC with Davical and calendar plugins from git.faster-it.com - any success?
by Ivars Strazdiņš 16 Oct '17

16 Oct '17

Hi, has anyone succeeded to setup RC with Davical and calendar plugins from these guys? https://git.faster-it.com/roundcube_calendar/about/ I have made two attempts, but calendar plugin throws error: [01-Jun-2017 15:44:21 +0300]: <lv2ds8jr> DAV Error: Not authenticated in /usr/share/roundcubemail/plugins/calendar/lib/SabreDAV/lib/OldSabre/DAV/Client.php on line 425 (GET /?_task=calendar) I have debugged that the plugin passes base64 encoded string '%p' instead of real user password to authentication backend. But why and how to fix that - I have no idea really. There is SabreDAV and OldSabre packed inside plugin which makes things even more interesting :/ Once, on my first attempt, I had managed to setup plugin so that it was able to write to CalDAV database, but not able to read (verified from other client). Now I cannot even repeat that with second installation. I get above error message on both GET and POST operations. I suspect it was a configuration thing so maybe that is all that's required to change. But I am not sure. It should be noted that their repository is not without problems, the fork claims a working configuration, but some functions (insert_default_calendar(), _expand_user()) were missing, I had to add them from original sources here: https://gitlab.awesome-it.de/kolab/roundcube-plugins/tree/feature_caldav Any insight appreciated. Thanks! Ivars

3 6

Re: [RCU] Reset RC settings to default
by absolutely_free＠libero.it 14 Oct '17

14 Oct '17

Hi, in your previous email (about deleting stuff from databases), did you mean: > delete from users where user username = 'someone(a)somedomain.com'; or only the "preferences" column's content? Because if I delete the entire row, I will delete user id too, and so it will be "inconsisent" with contacts table. Am I wrong? thankyou! > > Il 11 ottobre 2017 alle 20.27 Reindl Harald <h.reindl(a)thelounge.net> ha scritto: > > Am 11.10.2017 um 20:20 schrieb absolutely_free(a)libero.it: > > > > > > Hi, > > > > yes I did. But I don't know pretty much RC internals :) > > After next user's login, will his user_id be recreated? > > > > > > you are asking the question wrong! > > did you need to manually create it? > no > > did it got created at login? > since you did not create it manually - yes > > > > > > Thank you very much > > > > Il 11 ottobre 2017 alle 10.55 Reindl Harald <h.reindl(a)thelounge.net> > > ha scritto: > > > > Am 11.10.2017 um 10:50 schrieb absolutely_free(a)libero.it: > > > > is there a way to reset RC settings for some user? > > > > I am using RC 1.1.9 with MySQL backend > > > > did you even try to look at the database? > > just delete the database record for the user > > > > >

1 0

Reset RC settings to default
by absolutely_free＠libero.it 13 Oct '17

13 Oct '17

Hi, is there a way to reset RC settings for some user? I am using RC 1.1.9 with MySQL backend. Thank you

2 2

Re: [RCU] Reset RC settings to default
by absolutely_free＠libero.it 11 Oct '17

11 Oct '17

Hi, yes I did. But I don't know pretty much RC internals :) After next user's login, will his user_id be recreated? In case, is it necessary to manually modify contacts table to make address book working again for specific user? Thank you very much > > Il 11 ottobre 2017 alle 10.55 Reindl Harald <h.reindl(a)thelounge.net> ha scritto: > > Am 11.10.2017 um 10:50 schrieb absolutely_free(a)libero.it: > > > > > > is there a way to reset RC settings for some user? > > > > I am using RC 1.1.9 with MySQL backend > > > > > > did you even try to look at the database? > just delete the database record for the user > > MariaDB [roundcube_db]> show fields from users; > +----------------------+------------------+------+-----+---------------------+----------------+ > | Field | Type | Null | Key | Default > | Extra | > +----------------------+------------------+------+-----+---------------------+----------------+ > | user_id | int(10) unsigned | NO | PRI | NULL > | auto_increment | > | username | varchar(128) | NO | MUL | NULL > | | > | mail_host | varchar(128) | NO | | NULL > | | > | created | datetime | NO | | 1000-01-01 > 00:00:00 | | > | last_login | datetime | YES | | NULL > | | > | language | varchar(5) | YES | | NULL > | | > | preferences | longtext | YES | | NULL > | | > | failed_login | datetime | YES | | NULL > | | > | failed_login_counter | int(10) unsigned | YES | | NULL > | | > +----------------------+------------------+------+-----+---------------------+----------------+ > 9 rows in set (0.00 sec) > > MariaDB [roundcube_db]> select * from users where > username='h.reindl(a)thelounge.net'; > +---------+------------------------+-----------+---------------------+---------------------+----------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+--------------+----------------------+ > | user_id | username | mail_host | created | > last_login | language | preferences > > | failed_login | failed_login_counter | > +---------+------------------------+-----------+---------------------+---------------------+----------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+--------------+----------------------+ > | 1 | h.reindl(a)thelounge.net | 127.0.0.1 | 2012-03-03 01:50:57 | > 2017-09-24 21:44:54 | de_DE | > a:10:{s:11:"client_hash";s:32:"5b9d50d7dc8b4ffecc3b348d1c96cc04";s:11:"search_mods";a:5:{s:1:"*";a:2:{s:7:"subject";i:1;s:4:"from";i:1;}s:4:"Sent";a:2:{s:7:"subject";i:1;s:2:"to";i:1;}s:6:"Drafts";a:2:{s:7:"subject";i:1;s:2:"to";i:1;}s:5:"gmail";a:2:{s:7:"subject";i:1;s:4:"from";i:1;}s:5:"INBOX";a:2:{s:7:"subject";i:1;s:4:"from";i:1;}}s:16:"message_sort_col";s:4:"date";s:18:"message_sort_order";s:4:"DESC";s:9:"list_cols";a:7:{i:0;s:7:"threads";i:1;s:7:"subject";i:2;s:4:"from";i:3;s:4:"date";i:4;s:4:"size";i:5;s:10:"attachment";i:6;s:8:"priority";}s:22:"preview_pane_mark_read";i:5;s:10:"keep_alive";i:60;s:10:"prettydate";b:0;s:9:"junk_mbox";s:4:"junk";s:20:"default_imap_folders";a:5:{i:0;s:5:"INBOX";i:1;s:6:"Drafts";i:2;s:4:"Sent";i:3;s:4:"junk";i:4;s:5:"Trash";}} > | NULL | NULL | > +---------+------------------------+-----------+---------------------+---------------------+----------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+--------------+----------------------+ > 1 row in set (0.00 sec) > > MariaDB [roundcube_db]> >

1 0

Upgrade from 1.1.9 to 1.3.1
by absolutely_free＠libero.it 11 Oct '17

11 Oct '17

Hi, is it possible to upgrade RC from 1.1.9 to 1.3.1 without intermediate version? Thank you

2 1

Re: [RCU] SMTP and IMAP/STARTTLS
by Rich Lott 11 Oct '17

11 Oct '17

Hi On my first issue: wanting to use different SMTP settings for different hosts, I've found this plugin: https://gitlab.com/kolab-roundcube-plugins/ude-login which is not quite what I wanted but will do. However, I'm still having problems with starttls. There's two situations where I need to check/fix STARTTLS 1. When roundcube accesses a remote IMAP server to fetch mail. 2. When roundcube accesses a remote SMTP server to send mail. On 11/10/17 14:57, Reindl Harald wrote: > it does always when the server offers TLS and frankly it does even on > 127.0.0.1 and then complain about certificte not machting - but why > don#t you see the TLS connection in your maillog on the smtp server? Thanks, but in my situation I do not control either of the remote servers, so I cannot check their logs. I enabled imap_debug on roundcube but it does not seem to be clear : [11-Oct-2017 15:32:49 +0100]: <vgbmv43h> [50AA] S: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE *STARTTLS* AUTH=PLAIN] Dovecot ready. [11-Oct-2017 15:32:49 +0100]: <vgbmv43h> [50AA] C: A0001 ID ("name" "Roundcube" "version" "1.3.0 " "php" "7.0.19-1" "os" "Linux" "command" "/?_task=mail&_action=refresh") [11-Oct-2017 15:32:49 +0100]: <vgbmv43h> [50AA] S: * ID ("name" "Dovecot") [11-Oct-2017 15:32:49 +0100]: <vgbmv43h> [50AA] S: A0001 OK ID completed. [11-Oct-2017 15:32:49 +0100]: <vgbmv43h> [50AA] C: A0002 AUTHENTICATE PLAIN ****** [37] [11-Oct-2017 15:32:49 +0100]: <vgbmv43h> [50AA] S: A0002 OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE] Logged in I have enabled smtp_debug on roundcube. Here's the chat while SENDING to the SMTP server: Send: EHLO (xxxxx removed xxxx) Recv: 250-xxxxxx removed xxxxxx Recv: 250-PIPELINING Recv: 250-SIZE 30240000 Recv: 250-VRFY Recv: 250-ETRN Recv: 250-STARTTLS Recv: 250-ENHANCEDSTATUSCODES Recv: 250-8BITMIME Recv: 250 DSN Send: RSET Recv: 530 5.7.0 Must issue a STARTTLS command first Send: QUIT Recv: 221 2.0.0 Bye So it looks like RC is not sending STARTTLS back in response? ? -- Rich

2 1

Re: [RCU] SMTP and IMAP/STARTTLS
by Rich Lott 11 Oct '17

11 Oct '17

Hi On 11/10/17 15:41, Reindl Harald wrote: > fix your servers so that they don't allow login without TLS to start with As I said, I do not own nor control these servers. So I cannot reconfigure them, nor check their logs. /My/ servers /do /work the way you suggest, but I'm working with somebody else's :-) Anyway I have now resolved the problem. I had been confused because the user config is stored in session, so my changes were not taking affect without a log out/log in to RC. All fixed now anyway. Thanks for your time. -- Rich

1 0

SMTP and IMAP/STARTTLS
by Rich Lott 11 Oct '17

11 Oct '17

Hi I have two questions 1. Roundcube allows a list of domains for IMAP through the $config['default_host'] = Array() config option. The different hosts require different SMTP settings also, but it seems that the smtp settings are assumed to be static. Is there a hook or such that allows me to set some config after a user is logged in, and based on the host (etc) they selected? i.e. someone who selects foo.com as the host needs to send to smtp.foo.mailserver.com and someone who selects bar.com as the host needs to send via localhost. 2. My (externally controlled) IMAP host offers STARTTLS over port 143 (it does not open port 993). It's not clear to me whether RC is moving to TLS after the initial unencrypted connection. I don't want to use an insecure connection, but I can't see a way to check or specify that STARTTLS must be done? Many thanks, and apols if these are daft questions, but I have read the config files and wiki, I promise :-) -- Rich

1 0

Show always all IMAP folders
by Alessio Cecchi 09 Oct '17

09 Oct '17

Hi, in Roundcube 1.3 is possibile to ignore IMAP subscribe options and show always all IMAP folders for all users? Thanks -- Alessio Cecchi Postmaster @ http://www.qboxmail.it https://www.linkedin.com/in/alessice

1 0

Issue with address book after migration
by absolutely_free＠libero.it 03 Oct '17

03 Oct '17

Hi, I migrated my mail spool to a different server; in file config.inc.php I just changed accordingly $config['default_host'] to new hostname. nothing else. I didn't change anything about $config['db_dsnw'] = 'mysql://user:pass@externalserver.domain/database'; (in my case, address book is stored on external MySQL database). it seems that all address book are empty. I am using RC 1.1.9 Any help? Thank you

2 2

Scripts added into managesieve
by Jorge Bastos 29 Sep '17

29 Sep '17

Howdy, I have some users that got some managesieve scripts automatically, into their account. Via the sieve port (2000 or 4190) it's impossible 'cause it's closed to the outside. Maybe this was inserted with the previous version of RC that I had, that had almost 4years!! (I know too much) Did this happened to anyone? Here an image for general information for everyone. Don't know the intention of having the emails to these accounts.

1 0

reply to all from and reply-to vs from
by Andy Smith 28 Sep '17

28 Sep '17

Hi list, I recently upgrade to roundcube 1.2.5, I'm sorry not sure the exact version I had before. Anyway, my issue is there seems to have been a behaviour change to using reply to all. What I see now is that it replies to all both the From: and Reply-to: addresses from the mail headers. Previously, and in most other clients I've tested, only the Reply-to: header will be used. Its causing a bit of a headache with our ticketing system as people keep sending to both the from and reply-to addresses. Is this something I can easily modify in the code or config files? thanks, Andy.

1 0

Re: [RCU] Default's in .htaccess file
by Jorge Bastos 28 Sep '17

28 Sep '17

Reindl, No.. i just thing the default f ro the .htaccess file that cames with roundcube should be for php7. -----Original Message----- From: Reindl Harald [mailto:h.reindl@thelounge.net] Sent: 28 de setembro de 2017 09:41 To: Roundcube Users mailing list <users(a)lists.roundcube.net>; Jorge Bastos <mysql.jorge(a)decimal.pt> Subject: Re: [RCU] Default's in .htaccess file Am 27.09.2017 um 18:28 schrieb Jorge Bastos: > Howdy, > > In my opinion, in the .htaccess file, the default could came with php7, no? surely and smart guys have extended it up to PHP8 year sago [harry@rh:/www/www.rhsoft.net]$ cat temp/.htaccess <IfModule mod_php5.c> php_flag engine off </IfModule> <IfModule mod_php7.c> php_flag engine off </IfModule> <IfModule mod_php8.c> php_flag engine off </IfModule> > ### > > # WARNING: For PHP 7 the module name in the line below need to be modified! > > <IfModule mod_php5.c>

1 0

Default's in .htaccess file
by Jorge Bastos 27 Sep '17

27 Sep '17

Howdy, In my opinion, in the .htaccess file, the default could came with php7, no? ### # WARNING: For PHP 7 the module name in the line below need to be modified! <IfModule mod_php5.c> ###

1 0

Plugin for "cloud storage"
by Jorge Bastos 25 Sep '17

25 Sep '17

Howdy, Anyone know a plugin for storage to integrate with RC? Even if it's commercial. Thank you!!

3 4

roundcube 1.3.1 and missing files?
by Takahiro Kambe 25 Sep '17

25 Sep '17

Hi, While updating roundcube on pkgsrc to 1.3.1, I found some files seems to missing from roundcube 1.3.1. There are Jquery and TinyMCE files under program/js direcotry in roundcubemail-1.2.6.tar.gz. But roundcubemail-1.3.1.tar.gz contains only these js files. app.js app.min.js common.js common.min.js editor.js editor.min.js googiespell.js googiespell.min.js list.js list.min.js treelist.js treelist.min.js roundcubemail-1.2.6.tar.gz and roundcubemail-complete-1.3.1.tar.gz contains more files: program/js/jquery.min.js program/js/jstz.min.js program/js/publickey.js program/js/tinymce/... Yes, INSTALL file says "Install Javascript dependencies by executing `bin/install-jsdeps.sh` script." from days of 1.2.6. Roundcube 1.3.1 (or 1.3.0) changed policy of these bundling js files? Best regards. -- Takahiro Kambe <taca(a)back-street.net>

1 1

Re: [RCU] Help on logs
by Fábio Cabrita 23 Sep '17

23 Sep '17

Hello, Logs about logins are still being recorded? Em 20/09/2017 18:06, "Jorge Bastos" <mysql.jorge(a)decimal.pt> escreveu: Hi, I have: // Log successful/failed logins to <log_dir>/userlogins or to syslog $config['log_logins'] = false; In defaults.inc.php But for some reason, i’m having the logs beeing saved in logs/errors Any ideia what can be making it log? Jorge, _______________________________________________ Roundcube Users mailing list users(a)lists.roundcube.net http://lists.roundcube.net/mailman/listinfo/users

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Users