Installing and Running Roundcube Webmail on Ubuntu and Linux Mint

Roundcube Webmail turns any IMAP mailbox into a full-featured browser-based email client. It supports drag-and-drop message management, threaded conversations, address book with LDAP integration, spell checking, and a plugin architecture that extends functionality without touching core code. If you have ever wanted the convenience of web-based email without handing your correspondence to a third party, Roundcube running on your own Ubuntu or Linux Mint server is the solution.

This guide walks through a complete installation — from the LAMP prerequisites through database creation, Roundcube configuration, and post-install security hardening.

Prerequisites

Before installing Roundcube you need a working LAMP stack and an accessible IMAP/SMTP mail server.

LAMP Stack

Install Apache, MySQL, and PHP if they are not already present:

sudo apt-get update
sudo apt-get install apache2 mysql-server php5 php5-mysql php5-intl php5-mcrypt php5-gd php-pear libapache2-mod-php5

During the MySQL installation you will be prompted to set a root password. Choose a strong one and record it — you will need it shortly.

Enable the Apache rewrite module (required for clean URLs):

sudo a2enmod rewrite
sudo service apache2 restart

Verify PHP is functioning:

php -v

You should see PHP 5.3.x or later.

IMAP and SMTP Server

Roundcube does not send or receive mail on its own. It connects to:

• An IMAP server to read mail — commonly Dovecot.
• An SMTP server to send mail — commonly Postfix.

If you already have a mail server running (locally or remotely), note the IMAP host, IMAP port, SMTP host, and SMTP port. If you are setting up mail from scratch, install Dovecot and Postfix:

sudo apt-get install dovecot-imapd postfix

Select Internet Site when Postfix asks for the configuration type, and enter your domain name.

Step-by-Step Installation

Step 1: Create the MySQL Database

Log into MySQL:

mysql -u root -p

Create a database and a dedicated user for Roundcube:

CREATE DATABASE roundcubemail DEFAULT CHARACTER SET utf8 COLLATE utf8_general_ci;
CREATE USER 'roundcube'@'localhost' IDENTIFIED BY 'your_strong_password_here';
GRANT ALL PRIVILEGES ON roundcubemail.* TO 'roundcube'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Replace your_strong_password_here with a unique, strong password.

Step 2: Download Roundcube

Download the latest stable release to the web server directory:

cd /var/www
sudo wget https://github.com/roundcube/roundcubemail/releases/download/0.9.5/roundcubemail-0.9.5.tar.gz
sudo tar xzf roundcubemail-0.9.5.tar.gz
sudo mv roundcubemail-0.9.5 roundcube
sudo rm roundcubemail-0.9.5.tar.gz

Set ownership so Apache can read and write where necessary:

sudo chown -R www-data:www-data /var/www/roundcube
sudo chmod -R 755 /var/www/roundcube
sudo chmod -R 775 /var/www/roundcube/temp /var/www/roundcube/logs

Step 3: Import the Database Schema

Roundcube ships SQL initialisation scripts for MySQL, PostgreSQL, and SQLite. Import the MySQL schema:

mysql -u roundcube -p roundcubemail < /var/www/roundcube/SQL/mysql.initial.sql

Enter the Roundcube database user password when prompted.

Step 4: Configure Apache Virtual Host

Create a dedicated virtual host for Roundcube:

sudo nano /etc/apache2/sites-available/roundcube

Paste the following configuration:

<VirtualHost *:80>
    ServerName mail.example.com
    DocumentRoot /var/www/roundcube

    <Directory /var/www/roundcube>
        Options -Indexes
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/roundcube-error.log
    CustomLog ${APACHE_LOG_DIR}/roundcube-access.log combined
</VirtualHost>

Replace mail.example.com with your actual domain or server IP. Enable the site and reload Apache:

sudo a2ensite roundcube
sudo service apache2 reload

Step 5: Run the Installer

Open a browser and navigate to:

http://mail.example.com/installer/

The web-based installer checks PHP modules, lets you configure database credentials, IMAP host, SMTP host, and general preferences through a guided interface.

On the Database setup page, enter:

On the IMAP Settings page, enter:

On the SMTP Settings page, enter:

Click Create config to generate the configuration files, then Continue to test the database connection and IMAP login.

Step 6: Remove the Installer

Once configuration is complete, delete the installer directory to prevent unauthorised access:

sudo rm -rf /var/www/roundcube/installer

Step 7: Access Roundcube

Navigate to:

http://mail.example.com/

Log in with an email account that exists on your IMAP server. You should see the Roundcube inbox interface with your messages.

Roundcube Configuration Deep Dive

The main configuration file is /var/www/roundcube/config/main.inc.php. Key settings:

Session Lifetime

$rcmail_config['session_lifetime'] = 30;

Sets the idle timeout in minutes. For security on shared machines, keep this at 30 or lower.

Default Language

$rcmail_config['language'] = 'en_US';

Attachment Size Limit

This is controlled by PHP, not Roundcube. Edit /etc/php5/apache2/php.ini:

upload_max_filesize = 25M
post_max_size = 26M

Restart Apache after changes:

sudo service apache2 restart

Plugins

Enable plugins by adding them to the plugins array in main.inc.php:

$rcmail_config['plugins'] = array('archive', 'zipdownload', 'managesieve');

Available plugins are in /var/www/roundcube/plugins/. Each has its own config.inc.php for plugin-specific settings.

Security Hardening

Enable HTTPS

Install an SSL certificate and redirect all HTTP traffic to HTTPS:

sudo a2enmod ssl

Update the virtual host to listen on port 443 with your certificate paths:

<VirtualHost *:443>
    ServerName mail.example.com
    DocumentRoot /var/www/roundcube
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/mail.example.com.crt
    SSLCertificateKeyFile /etc/ssl/private/mail.example.com.key

    <Directory /var/www/roundcube>
        Options -Indexes
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>
</VirtualHost>

Add an HTTP-to-HTTPS redirect in the port 80 virtual host:

<VirtualHost *:80>
    ServerName mail.example.com
    Redirect permanent / https://mail.example.com/
</VirtualHost>

Restrict Database Privileges

After initial setup, revoke unnecessary privileges from the Roundcube database user:

REVOKE ALL PRIVILEGES ON roundcubemail.* FROM 'roundcube'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON roundcubemail.* TO 'roundcube'@'localhost';
FLUSH PRIVILEGES;

This prevents the Roundcube user from altering table structures or creating new tables after installation.

Disable Directory Listing

Ensure Options -Indexes is set in the Apache virtual host (already included above). This prevents browsers from listing the contents of directories that lack an index file.

Hide Sensitive Files

Add an .htaccess rule to block access to configuration and log files:

sudo tee /var/www/roundcube/.htaccess <<'EOF'
<FilesMatch "\.(inc|log|sql)$">
    Order deny,allow
    Deny from all
</FilesMatch>
EOF

Keep Roundcube Updated

Subscribe to the Roundcube security announcements mailing list. When a new version is released:

cd /var/www
sudo wget https://github.com/roundcube/roundcubemail/releases/download/x.y.z/roundcubemail-x.y.z.tar.gz
sudo tar xzf roundcubemail-x.y.z.tar.gz
sudo cp roundcube/config/main.inc.php roundcubemail-x.y.z/config/
sudo cp roundcube/config/db.inc.php roundcubemail-x.y.z/config/
sudo mv roundcube roundcube.old
sudo mv roundcubemail-x.y.z roundcube
sudo chown -R www-data:www-data /var/www/roundcube

Test the new version, then remove the old directory.

Common Pitfalls

1. Forgetting to install php5-intl. Roundcube requires the PHP Internationalization extension. Without it, the installer completes but the login page throws a fatal error. Install with sudo apt-get install php5-intl and restart Apache.
2. Leaving the installer directory in place. The /installer/ path exposes database credentials and server configuration to anyone who can reach it. Always delete it after setup.
3. Using the MySQL root account for Roundcube. This gives the web application full control over every database on the server. Always create a dedicated user with minimal privileges.
4. Ignoring PHP upload limits. Users will report that attachments fail silently. The default upload_max_filesize of 2 MB is too low for most email workflows. Increase it and post_max_size in php.ini.
5. Skipping HTTPS. Roundcube transmits email credentials over the network. Without TLS, usernames and passwords are sent in plain text. HTTPS is not optional for any mail interface.
6. Not setting file permissions correctly. If the temp/ and logs/ directories are not writable by www-data, Roundcube cannot cache sessions or write error logs, leading to silent failures and difficult debugging.

Testing the Installation

After completing all steps, verify end-to-end functionality:

# Confirm Apache is serving the site
curl -I http://mail.example.com/

# Confirm the database is populated
mysql -u roundcube -p -e "SHOW TABLES;" roundcubemail

# Send a test email from the Roundcube interface and confirm delivery

If the login page loads, you can authenticate with a valid IMAP account, and you can send and receive mail, the installation is complete.