SquirrelMail  
Donations
News
About
Support
Security
Screen shots
Download
Plugins
Documentation
Sponsors
Bounties





Junk Email Filter






Security Notice
Phishing campain
Version 1.4.15
Security Upgrade
Older Newer
Wed, 22 Oct 2008 22:26:27 . . . . squirrelmail.org [Formatting]


Changes by last author:

Added:
NOTE: For Unix install instructions check the QuickAndDirty install guide..

Installation instructions from file INSTALL in v1.4.3a download:

== Installing SquirrelMail ==

Table of Contents:

* (QUICK!) Quick install guide

* (PHP4) Configure your webserver to work with PHP4

* (IMAP) Setting up IMAP (not covered)

* (INSTALL) Obtaining and installing SquirrelMail

* (RUN) Running SquirrelMail

* (CHARSETS) Russian Charsets

== Quick install guide ==

Each of these steps is covered in detail below.

* Install webserver and PHP4 (at least 4.1.0).

* Install IMAP server (see docs of that server).

* Unpack the SquirrelMail package in a web-accessible location.

* Select a data-dir and attachment dir, outside the webtree (e.g. in /var). The data-dir (for user prefs) should be owned by the user the webserver runs as (eg www-data). The attachment dir (for uploading files as attachments) should be file mode 0730 and in the same group as the webserver.

* Run config/conf.pl from the command line. Use the D option to load predefined options for specific IMAP servers, and edit at least the Server Settings and General Options (datadir).

* Browse to http://www.example.com/yourwebmaillocation/ to log in.

== Configure your webserver to work with PHP4 ==

If your webserver does not already have PHP you must configure it to work with PHP. You need at least PHP v4.1.0. SquirrelMail uses the standard suffix .php for all PHP4 files.If you do use php-4.1.0, please set register_globals=off.I wouldn't guarantee the security of the webserver if you don't set it.

You can find PHP at http://www.php.net. See the documentation that comes with PHP for instructions how to set it up. The PHP IMAP extension is NOT neccessary at all (but won't harm)! The following list describes the optional PHP extensions:

* --with-ldap Required for LDAP addressbooks

* --with-mhash Will improve charset decoding if present

* --with-mysql For MySQL storage of preferences or addressbooks

* --with-openssl When you want to use encrypted IMAP connections (TLS)

If you're going to use LDAP in the addressbook, you must compile PHP with the LDAP extension. Include the MHASH extension to improve performance in character set decoding.

If you want your users to attach files to their mails, make sure File Uploads in php.ini is set to On.

== Setting up IMAP ==

This depends a lot on the server your choose. See the documentation that comes with your server. If you're concerned about people accessing it directly, you can limit access to only the IP of the webserver.

== uw-imapd ==

wu-imapd packages, plaintext passwords are disabled by default. This prevented SquirrelMail from using plaintext passwords to login. Since SquirrelMail and wu-imapd reside on the same server, Im not too concerned with someone seeing the traffic between the two services. So, to enable plaintext passwords and get SquirrelMail login working again, I did the following: First, I created a file called /etc/c-client.cf and had it contain the following two lines:

<code>

I accept the risk

set disable-plaintext 0

</code>

That's it! Save the file, and SquirrelMail should immediately start working again. No daemons to restart!

== xinetd issue ==

If you are running xinetd the /etc configuration file resulted in an xinetd configuration that only allows connections to localhost. The file in question is /etc/xinetd.conf and should have the "only_from" line removed or commented out.

== Obtaining and installing SquirrelMail ==

SquirrelMail is constantly being improved. Therefore you should always get the newest version around. Look at http://squirrelmail.org to see what it is. If you want to be bleeding edge you might want to consider using the latest CVS version (with the latest and most fashionable bugs).

a. Download SquirrelMail

Get SquirrelMail from the address above if you do not have it or are uncertain if you have the newest version. Untar (again tar xvfz filename.tgz) SquirrelMail in a directory that is readable for your webserver.

b. Setting up directories

SquirrelMail uses two directories to store user configuration and attachments that are about to be sent. You might want to have these directories outside of your web tree.

The data directory is used for storing user preferences, like signature, name and theme. When unpacking the sources this directory is created as data/ in your SquirrelMail directory. This directory must be writable by the webserver. If your webserver is running as the user "nobody" you can fix this by running:

<code>

$ chown -R nobody data

$ chgrp -R nobody data

</code>

Keep in mind that with different installations, the web server could typically run as userid/groupid of nobody/nobody, nobody/nogroup, apache/apache or www-data/www-data. The best way to find out is to read the web server's configuration file.

There also needs to be a directory where attachments are stored before they are sent. Since personal mail is stored in this directory you might want to be a bit careful about how you set it up. It should be owned by another user than the webserver is running as (root might be a good choice) and the webserver should have write and execute permissions on the directory, but should not have read permissions. You could do this by running these commands (still granted that the webserver is running as nobody/nobody)

<code>

$ cd /var/some/place

$ mkdir someDirectory

$ chgrp -R nobody someDirectory

$ chmod 730 someDirectory

</code>

If you trust all the users on you system not to read mail they are not supposed to read change the last line to chmod 777 someDirectory or simply use /tmp as you attachments directory.

If a user is aborting a mail but has uploaded some attachments to it the files will be lying around in this directory forever if you do not remove them. To fix this, it is recommended to create a cron job that deletes everything in the attachment directory. Something similar to the following will be good enough:

<code>

$ cd /var/attach/directory

$ rm -f *

</code>

However, this will delete attachments that are currently in use by people sending email when the cron job runs. You can either (1) make sure that the cron job runs at an obscure hour and hope that nobody gets upset, or (2) you can run a modified version of the commands above. Check out the man pages for other commands such as 'find' or 'tmpreaper'.

One sample script you could set up that would erase all attachments, but wouldn't erase preferences, address books, or the like (just in case your attachment directory is the same as your data directory) might look like this:

<code>

$ rm `find /var/attach/directory -atime +2 | grep -v "\." | grep -v _`

</code>

Remember to be careful with whatever method you do use, and to test out the command before it potentially wipes out everyone's preferences.

c. Setting up SquirrelMail

There are two ways to configure SquirrelMail. In the config/ directory, there is a perl script called conf.pl that will aid you in the configuration process. This is the recommended way of handling the config.

You can also copy the config/config_default.php file to config/config.php and edit that manually.

== Running SquirrelMail ==

Point your browser at the URL at which SquirrelMail is installed. A possible example of this is:

<code>

http://www.example.com/squirrelmail

</code>

It should be pretty straight forward to use. Some more documentation might show up one day or another.

== Russian charsets ==

For information on how to make SquirrelMail work with Russian Apache, see the README.russian_apache in the doc/ subdirectory.

© 1999-2016 by The SquirrelMail Project Team