- Users - Roundcube mailing lists

Re: [RCU] Roundcube Webmail 1.3.5 released
by A.L.E.C 16 Mar '18

16 Mar '18

On 15.03.2018 23:18, Jorge Bastos wrote: > Hi Thomas, > > Thank you and Alec for new relase! > > Just curious, 1.4 has any date already? April or May for the beta release and around 3 months more for stable. -- Aleksander 'A.L.E.C' Machniak Kolab Groupware Developer [http://kolab.org] Roundcube Webmail Developer [http://roundcube.net] ---------------------------------------------------- PGP: 19359DC1 # Blog: https://kolabian.wordpress.com

2 1

Roundcube Webmail 1.3.5 released
by Thomas Bruederli 15 Mar '18

15 Mar '18

Dear subscribers We proudly announce a new service release to update the stable version 1.3. It contains fixes to some issues which we backported from the master branch. One can be called a minor security fix as it fixes blocking of remote content on specially crafted style tags. See the full changelog in the release notes on the Github download page [1]. This release is considered stable and we recommend to update all productive installations of Roundcube with this version. Download it from https://roundcube.net. And stay tuned for the upcoming 1.4 beta release which will include a preview to the new "Elastic" theme. Apropos: we're still looking for a volunteer designer to do the final polishing on the new skin. Read about the progress of the Elastic skin in Alec's blog [2]. Best, Thomas & Alec [1] https://github.com/roundcube/roundcubemail/releases/tag/1.3.5 [2] https://kolabian.wordpress.com/tag/elastic/

2 1

Pop3 push
by Jorge Bastos 14 Mar '18

14 Mar '18

Hi, Is there any plugin for pop3 push? Even that is a commercial one? Thanks in advanced,

1 0

roundcube password plugin changing mysql password
by David Mehler 09 Mar '18

09 Mar '18

Hello, I'm a first time poster. I use Roundcube 1.3.4 on a FreeBSD system. I use postfix which gets it's authentication from dovecot imap server and goes to a MySQL database. I am now wanting to get roundcube's password plugin to be able to change a users password. In the password plugin configuration file I had this originally: update virtual_users set password=CONCAT('{SHA512-CRYPT}', ENCRYPT (%p, CONCAT('$6$', SUBSTRING(SHA(RAND()), -16)))) WHERE user=%u; This didn't work nor did it return any debug information. I then went in to MySQL directly and did this: update virtual_users set password=CONCAT('{SHA512-CRYPT}', ENCRYPT ('PasswordGoesHere', CONCAT('$6$', SUBSTRING(SHA(RAND()), -16)))) WHERE user='Username goes here'; Directly at the MySQL prompt this worked replaced user and password with values and it got returned correctly. I then did this with %p and %u as it appeared that not having them quoted was causing an error. Through none of this am I getting any kind of debug or log output: update virtual_users set password=CONCAT('{SHA512-CRYPT}', ENCRYPT ('%p', CONCAT('$6$', SUBSTRING(SHA(RAND()), -16)))) WHERE user='%u'; I try to change the password and I get brought back to the same screen, no errors on the screen and nothing in a log, the password does not get changed. Any suggestions or ways I can get some logging information? Also, when doing the change at the MySQL prompt I got a warning, doing a show warnings revealed error 1287 that the ENCRYPT function is deprecated and to use AES_ENCRYPT instead. I tried replacing ENCRYPT with AES_ENCRYPT and that didn't work. Any suggestions on either issue welcome. Thanks. Dave.

1 1

Roundcube Display HTML
by Mario Jorge Lima 08 Mar '18

08 Mar '18

Hi, If I let Roundcube to "DISPLAY HTML" for any account, I receive a Error 500 when trying to open an email. WHen I deselect it in "Roundcube >> Settings >> Preferences >> Displaying Messages" everything works. So I need one of these: 1) To solve this Error 500 or 2) To deselect this parameter above for any account, is there a way of setting it as a global parameter? Mario./ ___________________________ Mario Jorge Lima mariolima(a)multisites.com.br OBS: Eventualmente nao acentuo algumas palavras do Portugues, para evitar bugs na recepcao dos emails.

2 3

Does RCM support MIME Digests? ie so replying to an item in a digest doesn't break the thread . .
by Philip Rhoades 07 Mar '18

07 Mar '18

People, IT looks like RCM can't do this? Thanks, P. -- Philip Rhoades PO Box 896 Cowra NSW 2794 Australia E-mail: phil(a)pricom.com.au

2 4

Fontsize
by Andreas Meyer 05 Mar '18

05 Mar '18

Hi! A user complains the font being to small. Can the fontsize be set? Kind regards Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

4 5

Cannot send mail via round cube
by ɹןʇnqן 03 Mar '18

03 Mar '18

Mar 1 09:27:02 mail submit-tls/smtpd[86118]: connect from localhost[127.0.0.1] Mar 1 09:27:02 mail submit-tls/smtpd[86118]: SSL_accept error from localhost[127.0.0.1]: 0 Mar 1 09:27:02 mail submit-tls/smtpd[86118]: warning: TLS library problem: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca:/usr/src/crypto/openssl/ssl/s3_pkt.c:1493:SSL alert number 48: Mar 1 09:27:02 mail submit-tls/smtpd[86118]: lost connection after STARTTLS from localhost[127.0.0.1] Mar 1 09:27:02 mail submit-tls/smtpd[86118]: disconnect from localhost[127.0.0.1] ehlo=1 starttls=0/1 commands=1/2 Sending mail on the submission port outside of roundcube works fine. Mar 1 09:35:35 mail submit-tls/smtpd[26307]: connect from unknown[24.71.178.2] Mar 1 09:35:36 mail submit-tls/smtpd[26307]: Anonymous TLS connection established from unknown[24.71.178.2]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits) Mar 1 09:35:36 mail submit-tls/smtpd[26307]: NOQUEUE: permit: RCPT from unknown[24.71.178.2]: action=permit_sasl_authenticated for Client host=unknown[24.71.178.2] ; from=<lbutler(a)covisp.net> to=<user(a)example.net> proto=ESMTP helo=<[10.0.2.45]> Mar 1 09:35:36 mail last message repeated 2 times Mar 1 09:35:36 mail submit-tls/smtpd[26307]: 3zsdMr46Q6zbRf3: client=unknown[24.71.178.2], sasl_method=PLAIN, sasl_username=lbutler -- L Butler 303 219 0564

7 15

Re: [RCU] Cannot send mail via round cube
by Maarten 03 Mar '18

03 Mar '18

When roundcube connects to an imap or smtp server it's being a client therefore I think it would be logical that the client needs to validate the chain. When you are connecting to roundcube webinterface you are connecting to the server serving it, in that setting the browser is the client and the apache/nginx being the server. It's all a matter of who is the client and who is the server perspective as in who needs to validate and who needs to show they have a valid chain. On 03/03/2018 12:44 PM, Reindl Harald wrote: > > > Am 03.03.2018 um 12:29 schrieb Reindl Harald: >> Am 03.03.2018 um 10:08 schrieb Maarten: >>> If I understand ssl correctly I don't see the point to putting >>> fullchain.pem letsencrypt there, because of the following. Your browser >>> has the Root certificates installed, a php application does not. So >>> when >>> >>> you go to a webpage using letsencrypt certificates . You will see >>> something like this: >>> >>> DST Root CA X2 --> Root Certificate in browser >>> >>> Let's encrypt Authority X3 --> >>> >>> webmail.yourdomain.com --> your certificate >>> >>> >>> So the web browser uses the Root Certificate to verify the chain of >>> certificates to be valid. As far as I know a php application has no way >>> knowing if the service it's connecting to is using a valid ssl chain, I >>> don't know enough about php to be sure about this but sounds >>> correct. If >>> I am wrong about this someone may correct me about this and explain it >>> to me how this works in php. >> >> exactly the same way as on the browser side >> no idea why you think PHP is special here >> >> "As far as I know a php application has no way knowing if the service >> it's connecting to is using a valid ssl chain" is pure bullshit - get >> a proper maintained operating system and you have all working >> out-of-the-box >> >> http://php.net/manual/en/migration56.openssl.php >> >> All encrypted client streams now enable peer verification by default. >> By default, this will use OpenSSL's default CA bundle to verify the >> peer certificate. In most cases, no changes will need to be made to >> communicate with servers with valid SSL certificates, as distributors >> generally configure OpenSSL to use known good CA bundles > it's using even the same ca-bundle than everything else on the system, > the ca-bundle from mozilla - frankly do you think the php-devleopers > are idiots and enable verification by default when it won't work on > any reasonable server? > > [harry@srv-rhsoft:~]$ rpm -q --filesbypkg > openssl-libs-1.1.0g-1.fc27.x86_64 > openssl-libs /etc/pki/tls > openssl-libs /etc/pki/tls/certs > openssl-libs /etc/pki/tls/misc > openssl-libs /etc/pki/tls/openssl.cnf > openssl-libs /etc/pki/tls/private > .... > > [harry@srv-rhsoft:~]$ ls /etc/pki/tls/certs > total 4.0K > -rw-r--r-- 1 root root 2.5K 2017-11-06 09:24 Makefile > lrwxrwxrwx 1 root root 49 2018-02-06 14:48 ca-bundle.crt -> > /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem > lrwxrwxrwx 1 root root 55 2018-02-06 14:48 ca-bundle.trust.crt -> > /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt > > [harry@srv-rhsoft:~]$ rpm -q --file > /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem > ca-certificates-2018.2.22-1.0.fc27.noarch > > [harry@srv-rhsoft:~]$ rpm -q --info > ca-certificates-2018.2.22-1.0.fc27.noarch > Name : ca-certificates > Version : 2018.2.22 > Release : 1.0.fc27 > Architecture: noarch > Install Date: Thu Feb 8 09:43:10 2018 > Group : System Environment/Base > Size : 974873 > License : Public Domain > Signature : RSA/SHA256, Tue Feb 6 14:57:19 2018, Key ID > f55e7430f5282ee4 > Source RPM : ca-certificates-2018.2.22-1.0.fc27.src.rpm > Build Date : Tue Feb 6 14:48:33 2018 > Build Host : buildvm-ppc64le-04.ppc.fedoraproject.org > Relocations : (not relocatable) > Packager : Fedora Project > Vendor : Fedora Project > URL : https://fedoraproject.org/wiki/CA-Certificates > Summary : The Mozilla CA root certificate bundle > Description : > This package contains the set of CA certificates chos

1 0

Size of attachments
by Andreas Meyer 01 Mar '18

01 Mar '18

Hello! Writing a mail on the right side I see "maximun allowed size is 5,0 MB. Where is this value set? Kind regards Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

1 1

another PGP thingi
by Andreas Meyer 01 Mar '18

01 Mar '18

Hello! I run two domains on one host. With one I have no problem using PGP with the otherone it does not work. Both domains use version 1.3.3 and enigma 0.7. Importing keys works, signing and encryption does not. I set $config['debug_level'] = 4; but nothing is logged at the moment. How can I debug that thing? I get the pinentry thing to input the passphrase and then it says signing failed. Regards Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

1 2

Re: [RCU] Design larry
by Andreas Meyer 01 Mar '18

01 Mar '18

Reindl Harald <h.reindl(a)thelounge.net> schrieb am 01.03.18 um 17:36:04 Uhr: > Am 01.03.2018 um 17:28 schrieb Andreas Meyer: > > Is it possible to not let the user choose between the styles larry > > and classic? > > surely, my rpmbuild even removes "larry" before generating the package > in the %install section > > $rcmail_config['skin'] = 'classic'; I have $config['skin'] = 'larry' already set. Nevertheless in the settings one can choose between classic and larry style. Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

2 1

Question regarding PGP
by Andreas Meyer 01 Mar '18

01 Mar '18

Hello! Is see this in the log: [01-Mar-2018 18:12:15 Europe/Berlin] PHP Warning: exec() has been disabled for security reasons in /vwww/HIDDEN/root/mailsystem/vendor/pear/crypt_gpg/Crypt/GPG/ProcessControl.php on line 143 Do I have to enable exec() in the php.ini? Kind regards Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

2 2

Design larry
by Andreas Meyer 01 Mar '18

01 Mar '18

Hello! Is it possible to not let the user choose between the styles larry and classic? Kind regards Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

1 0

How to avoid accessing mailboxes elsewhere
by Mario Jorge Lima 27 Feb '18

27 Feb '18

Hello, I will explain what I need to know. I have 3 Servers: 1) One of them is just a Domains Server. 2) The other two are Mailboxes Servers. They have the email accounts for all the Domains from the first Server. All these mailboxes' POP and SMTP are accessed through the Server address: mail.domainnamea.com. mail.domainnameb.com. mail.domainnamec.com. and so on. If someone who accesses my Roundcube, fill the Server field with any other POP Server name elsewhere, he will read those emails. How to avoid it, so that only mailboxes in one of my two Mailboxes mentioned above can be accessed? Thanks a lot. Mario./ ___________________________ Mario Jorge Lima mariolima(a)multisites.com.br OBS: Eventualmente nao acentuo algumas palavras do Portugues, para evitar bugs na recepcao dos emails.

4 4

Re: [RCU] [misc] failed to connect socket
by Roundcube 23 Feb '18

23 Feb '18

On 2018-02-23 (19:35 MST), Reindl Harald <h.reindl(a)thelounge.net> wrote: > > Am 24.02.2018 um 00:24 schrieb Roundcube: >> When trying to send an email from Roundcube I get: >> Connection failed: Failed to connect socket: fsockopen(): unable to connect to ssl://mail.covisp.net:587 > > it's as simple as port 587 is tls:// and not ssl:// > SSL versus STARTSSL You didn't see 3 lines down: >> If I change it to tls://mail.covisp.net I get: >> >> SMTP Error in /usr/local/www/roundcube/program/lib/Roundcube/rcube.php (1675): Authentication failure: STARTTLS failed (Code: ) -- Honesty may be the best policy, but it's important to remember that apparently, by elimination, dishonesty is the second-best policy.

1 0

failed to connect socket
by Roundcube 23 Feb '18

23 Feb '18

When trying to send an email from Roundcube I get: Connection failed: Failed to connect socket: fsockopen(): unable to connect to ssl://mail.covisp.net:587 Sending from any other mail client works on the submission port, so it is not a mail server configuration issue. If I change it to tls://mail.covisp.net I get: SMTP Error in /usr/local/www/roundcube/program/lib/Roundcube/rcube.php (1675): Authentication failure: STARTTLS failed (Code: ) $ openssl s_client -connect mail.covisp.net:587 -starttls smtp CONNECTED(00000003) depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3 verify error:num=2:unable to get issuer certificate issuer= O = Digital Signature Trust Co., CN = DST Root CA X3 --- Certificate chain 0 s:/CN=covisp.net i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 i:/O=Digital Signature Trust Co./CN=DST Root CA X3 --- Server certificate -----BEGIN CERTIFICATE----- MIIGXDCCBUSgAwIBAgISA8l2HqqZkKGc4w829muF4nnZMA0GCSqGSIb3DQEBCwUA MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xODAyMTMyMDIxMjZaFw0x ODA1MTQyMDIxMjZaMBUxEzARBgNVBAMTCmNvdmlzcC5uZXQwggIiMA0GCSqGSIb3 DQEBAQUAA4ICDwAwggIKAoICAQCjK35UbUb6YSMSzto4KgLPGv/h8jvkRMYuV3al iV28dXMEPUJ8vhGsLbXaMVKouZnrWMgJ7ws6TlzXNPuMnXuoplvhLMtXNKyAtyaI X0Hhhsb3yAfj2WI7FN15kedKnGFzNPDBuo8+g6q0yRgyj1erNj/K8xWwokpcpVrU Q5zsKnyqU9MHmmcyNFNFyCQ+quCfCLcK4T1klrQGKG564HQcj0hEXFZx6txj7irF Zul/0Ju2XdDaaF114+Fq2K/XCuRWfyWAGTSh8z7e/4CU0MDnnqIAVWcWfeeHLjTU 2hRd7TQEH0DWg1C95zHk0yLn2JJ/ffj0q/+RK8G8yjKogv351VNgfjbkoCxnluFS lYx5IPUdRvplEWOEMdtcvLf7J+S+e+Kf3u643SMKwblOboA9yqWyIrp32voxCWoF kVkO84E70U1yCZ4rbVcF9CwEySi/1la7Nm7Bnr24ByJT46TBlAKPEwUaj0VJeHi4 oHxXAZ3IYjdMgbT+DPWiz/jCrdahQrJC++HFaoqLd+dPGlla3Rn/FjigpABqJUJj YNLAXwP2hY2W1bRdJDjBG7978Uy8h2Ec8TTBjOSIHgQOoxFyuPg+kCinELPFxXmI +kxrtwpKelnxHpH5JdFDLIHN80TAqr5v2CnMA+9JSOjX6z6Yvpwom9LWJ9z34vpn X77OjQIDAQABo4ICbzCCAmswDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsG AQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRsPUj9me0H 2wqRgbnPiD2RIYvPUzAfBgNVHSMEGDAWgBSoSmpjBH3duubRObemRWXv86jsoTBv BggrBgEFBQcBAQRjMGEwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwLmludC14My5s ZXRzZW5jcnlwdC5vcmcwLwYIKwYBBQUHMAKGI2h0dHA6Ly9jZXJ0LmludC14My5s ZXRzZW5jcnlwdC5vcmcvMHoGA1UdEQRzMHGCCmNvdmlzcC5uZXSCD21haWwuY292 aXNwLm5ldIIVcGhwbXlhZG1pbi5jb3Zpc3AubmV0ghdwb3N0Zml4YWRtaW4uY292 aXNwLm5ldIISd2VibWFpbC5jb3Zpc3AubmV0gg53d3cuY292aXNwLm5ldDCB/gYD VR0gBIH2MIHzMAgGBmeBDAECATCB5gYLKwYBBAGC3xMBAQEwgdYwJgYIKwYBBQUH AgEWGmh0dHA6Ly9jcHMubGV0c2VuY3J5cHQub3JnMIGrBggrBgEFBQcCAjCBngyB m1RoaXMgQ2VydGlmaWNhdGUgbWF5IG9ubHkgYmUgcmVsaWVkIHVwb24gYnkgUmVs eWluZyBQYXJ0aWVzIGFuZCBvbmx5IGluIGFjY29yZGFuY2Ugd2l0aCB0aGUgQ2Vy dGlmaWNhdGUgUG9saWN5IGZvdW5kIGF0IGh0dHBzOi8vbGV0c2VuY3J5cHQub3Jn L3JlcG9zaXRvcnkvMA0GCSqGSIb3DQEBCwUAA4IBAQBONofC5LjFT2KSgkPjvuus shIprx/VYgOpfgFCvAmkQCbpLp8NmS8r4Dg9mMAqh/uhPgRV6BoGiuBR7eJRKH/W /sOY0AtysFxdslWb0hhCjaTXEGNz8c9z53xslNlU1ggp2k71FVzbFfhKnaDbYwem XXyquK2QKg5yPWxGmsfMSyNuP8q/qHCqBRiOWNxozSHw1k0Qr9cod1748hd/+HG4 nGBUiIQUPEJdWm3b+zvlr0PBKaOC4j3LSQpXj4FvHDy19DxxkmVNEE4+px5B0qJ9 WeXyPb2Hop4Ly6o9UKaynICgYEC2CXrRv7GZ/oGesdpF7k9mEA5Tt1nbW+rp+exF -----END CERTIFICATE----- subject=/CN=covisp.net issuer=/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 --- No client certificate CA names sent Peer signing digest: SHA512 Server Temp Key: ECDH, P-256, 256 bits --- SSL handshake has read 3783 bytes and written 468 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 4096 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: 41E4C231E6E193E6DAC1CFBA6C890132BD10B24467F056BEBB68BEE0D5D2E275 Session-ID-ctx: Master-Key: E40F4A64F059BE52089D0F1F5CCF7E0640C870C618FA4FB97337AF1ED43F4F3A325610088EC67BCB2C5113E5E7CC3D9B Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1519428085 Timeout : 300 (sec) Verify return code: 2 (unable to get issuer certificate) --- 250 DSN -- ɹןʇnqן lbutler(a)covisp.net

1 0

Request security check failed
by Jorge Bastos 23 Feb '18

23 Feb '18

Howdy, I've been seen this info in the logs, and my question is, is this some sort of hack attempt, or should not care about? Jorge, == Feb 22 19:36:52 fastweb roundcube: <h9lj7u9d> PHP Error: Request security check failed (GET /webmail/?_task=logout&_token=4gqJNrvLh3TYhjN4dYxEcV8pba8oT6Q8)

1 1

Export mail folders and messages
by Wendy Quihampton 20 Feb '18

20 Feb '18

Hi Is it possible to export mail folders and messages? Wendy Quihampton Project Manager, Digital Access to Collections E: wendy.quihampton(a)museumsaustralia.org.au M: 0428 587 737 Museums Galleries Australia GLAM Peak www.digitalcollections.org.au

1 0

Example for manage sieve of: /etc/dovecot/sieve/global
by Jorge Bastos 13 Feb '18

13 Feb '18

Howdy, Where could i see an example of whats inside or what would be possible to add there, for the default that comes in manage sieve plugin config.php "/etc/dovecot/sieve/global" Thanks.

1 0

Permissions of enigma/home
by Andreas Meyer 12 Feb '18

12 Feb '18

Hello! What are the right permissions for content of plugins/enigma/home/user(a)domain.org? At the moment it looks like this: drwx------ 2 root root 4096 30. Mai 2016 private-keys-v1.d -rw------- 1 root root 10057 7. Apr 2017 pubring.gpg -rw------- 1 root root 7548 7. Apr 2017 pubring.gpg~ -rw------- 1 root root 600 7. Apr 2017 random_seed -rw------- 1 root root 2685 7. Apr 2017 secring.gpg But that's not right. What's best? Kind regards Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

2 1

Re: [RCU] Security issue (possible?) (was: RE: Unknown user in users table, very odd, possible security hole)
by A.L.E.C 11 Feb '18

11 Feb '18

On 02/09/2018 09:28 PM, Jorge Bastos wrote: > Well yes, but now i'm thinking, i have the imap server set to be dynamic > it's filled with: > > mail. + domain.tld > > ok this option in Roundcube is grrreeeaaattt, but I think it makes people > use my server for webmail! Damn! > > How would I tell Roundcube, to connect just to my ip's? > I could do this via iptables but is some shared hosting user wants to > connect to any imap server he would be blocked You have a few options to deal with this default_host username_domain username_domain_forced login_username_filter trusted_host_patterns How to use them will depend on what you want to achieve and your environment. You can always create a plugin that checks the host before connecting to it. -- Aleksander 'A.L.E.C' Machniak Kolab Groupware Developer [http://kolab.org] Roundcube Webmail Developer [http://roundcube.net] ---------------------------------------------------- PGP: 19359DC1 # Blog: https://kolabian.wordpress.com

2 1

LDAP address book - problem with groups
by Franta Hanzlík 11 Feb '18

11 Feb '18

Hi, new to Roundcube, I have still some confusion about configuring the LDAP address book. Please, is somewhere a little detailed description of the configuration scenarios and individual options? Now I have something as this (found somewhere on the net): $config['ldap_public']['public'] = array( 'name' => 'Public LDAP Addressbook', 'hosts' => array('ldap.mydomain'), 'base_dn' => 'o=spse', 'bind_dn' => 'cn=binduser,o=myorg', 'bind_pass' => 'binduseracces', 'filter' => '(&(objectClass=inetOrgPerson)(cn=z*))', 'sort' => 'sn', 'global_search' => true, 'fuzzy_search' => true, 'groups' => array( 'base_dn' => '', 'mail' => '{Mail-Address}(a)mydomain.com', 'filter' => '(&(objectClass=groupOfNames)(Mail-Address=*))', 'object_classes' => array("top", "groupOfNames"), 'class_member_attr' => array( 'groupofnames' => 'member', 'groupofuniquenames' => 'uniquemember' ), ), 'name_field' => 'uid', 'email_field' => 'mail', 'surname_field' => 'sn', 'firstname_field' => 'givenName', 'scope' => 'sub' ); and although as I understand the description for individual people, I do not even understand the description of groups - whole this block: 'groups' => array( 'base_dn' => '', 'mail' => '{Mail-Address}(a)mydomain.com', 'filter' => '(&(objectClass=groupOfNames)(Mail-Address=*))', 'object_classes' => array("top", "groupOfNames"), 'class_member_attr' => array( 'groupofnames' => 'member', 'groupofuniquenames' => 'uniquemember' ), ), - why it is included just where it is? - what is meant by: 'object_classes' => array("top", "groupOfNames"), ? what is block: 'class_member_attr' => array( 'groupofnames' => 'member', 'groupofuniquenames' => 'uniquemember' ), In spite of all the confusion, RC puts something out. But what bothers me and I need to have it differently: - when in new mail I write recipient address, autocompletion offers me the required group. But when I click on it, in the address bar appears no single address (groupname@mydomain), but mail addresses of all group members! What with this? - in address book menu, I want to display group names (as is now), but not their members (or at least not to all RC users). Is this possible somehow? I'm trying Roundcube version 1.3.4, LDAP DB is some commercial one with schema roughly corresponding with Openldap core, and groups are defined as: dn: cn=_groupName_,ou=Groups,o=myorg Mail-Address: _groupName_ objectClass: groupOfNames objectClass: Top objectClass: Mail-Group member: cn=_user1_,ou=XX,o=myorg member: cn=_user2_,ou=YY,o=myorg ... cn: _groupName_ (there isn't complete mail address - only part before '@'. All groups in addressbook are in one domain) Thanks in advance for your help! Franta Hanzlik

2 2

Security issue (possible?) (was: RE: Unknown user in users table, very odd, possible security hole)
by Jorge Bastos 09 Feb '18

09 Feb '18

ALEC!!!!!!! There's some security problem in RC I believe! Check this: Feb 9 01:46:44 fastweb roundcube: <ibj96bvb> Successful login for donny(a)adhigunaputera.com (ID: 100412) from 110.136.11.0 in session ibj96bvbj5akqlt5slpc47ikfb This user doesn't belong to any of the IMAP accounts, how was he able to login? After the login, there's some login failed lines: Feb 9 02:47:27 fastweb roundcube: <ibj96bvb> IMAP Error: Login failed for donny(a)adhigunaputera.com from 110.136.11.0. Empty startup greeting (mail.adhigunaputera.com:143) in /home/hosting/dhosting.pt/webmail/program/lib/Roundcube/rcube_imap.php on line 196 (POST /webmail/?_task=mail&_action=refresh) Feb 9 02:48:37 fastweb roundcube: <ibj96bvb> IMAP Error: Login failed for donny(a)adhigunaputera.com from 110.136.11.0. Empty startup greeting (mail.adhigunaputera.com:143) in /home/hosting/dhosting.pt/webmail/program/lib/Roundcube/rcube_imap.php on line 196 (POST /webmail/?_task=mail&_action=refresh) Feb 9 02:49:47 fastweb roundcube: <ibj96bvb> IMAP Error: Login failed for donny(a)adhigunaputera.com from 110.136.11.0. Empty startup greeting (mail.adhigunaputera.com:143) in /home/hosting/dhosting.pt/webmail/program/lib/Roundcube/rcube_imap.php on line 196 (POST /webmail/?_task=mail&_action=refresh (funny the IP is the network IP) What's the best place to move forward with investigation with this issue, here or dev list? Could you assist me on this? Thank you in advanced, From: users-bounces(a)lists.roundcube.net [mailto:users-bounces@lists.roundcube.net] On Behalf Of Hannu Hirvonen Sent: 8 de fevereiro de 2018 20:43 To: users(a)lists.roundcube.net Subject: Re: [RCU] Unknown user in users table, very odd, possible security hole On 08.02.2018 22:34, Jorge Bastos wrote: Not in there but you made me remind about: // Log successful/failed logins to <log_dir>/userlogins or to syslog That's why I said "something like ...", might have been a bit clearer, of course :-) -- Hannu Hirvonen (hh(a)uwasa.fi <mailto:hh@uwasa.fi> , http://www.uwasa.fi/~hh/) Computer Centre, University of Vaasa, BOX 700, FI-65101 VAASA, Finland

2 3

Re: [RCU] Unknown user in users table, very odd, possible security hole
by Hannu Hirvonen 08 Feb '18

08 Feb '18

On 08.02.2018 22:34, Jorge Bastos wrote: > > Not in there but you made me remind about: > > // Log successful/failed logins to <log_dir>/userlogins or to syslog > That's why I said "something like ...", might have been a bit clearer, of course :-) -- Hannu Hirvonen (hh(a)uwasa.fi, http://www.uwasa.fi/~hh/) Computer Centre, University of Vaasa, BOX 700, FI-65101 VAASA, Finland

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Users