Roundcube 1.7 on Ubuntu 24.04 on Azure User Guide

Overview

Roundcube is the widely used open source browser based IMAP mail client. It gives users folder management, threaded conversations, a rich text composer, a searchable address book and a responsive interface that works from desktop to phone. The cloudimg image installs Roundcube 1.7 from the official release, fronted by nginx with PHP 8.3 and backed by a local MariaDB for preferences and contacts, all from the Ubuntu 24.04 noble archive with no third party APT repositories.

Roundcube is a mail client, not a mail store, so a bare Roundcube install has nothing to sign in to. This image therefore also bundles a Dovecot IMAP server holding a real mailbox and a loopback only Postfix mail transfer agent, so you can sign in, read and compose the moment the instance boots. You can keep that bundled mailbox, or repoint Roundcube at your own corporate mail server by changing two settings — both paths are covered below.

What is included:

• Roundcube Webmail 1.7.2 from the official release, served from /var/www/roundcube
• nginx with the Roundcube vhost at /etc/nginx/sites-available/cloudimg-roundcube, docroot public_html
• PHP 8.3 with the pdo_mysql, intl, mbstring, xml, gd, zip, curl, ldap, bcmath and opcache extensions
• MariaDB with the roundcube database and roundcube app user on loopback only
• Dovecot IMAP and LMTP with a virtual mailbox user, on loopback only
• Postfix bound to loopback-only, delivering into Dovecot over LMTP — never an open relay
• roundcube-firstboot.service rotating the mailbox password, the database password and the des_key encryption key per instance
• roundcube-cleandb.timer running Roundcube's own database housekeeping daily
• The MariaDB database and the Dovecot maildir on a dedicated Azure data disk mounted at /data
• nginx, php8.3-fpm, mariadb, dovecot and postfix enabled and auto starting on boot
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key, and a VNet with a subnet. Standard_B2s (2 vCPU, 4 GB RAM) suits a small team; move up to a larger burstable or a D series size for heavier mailbox usage. Open ports 80 and 443 on the network security group, plus 22 for SSH from your management address. Do not open 25, 143, 993 or 3306 — the mail and database services are deliberately bound to loopback.

Step 1 to 3: Deploy and connect

Deploy the image from the Azure Marketplace, then connect over SSH:

ssh azureuser@<vm-ip>

Step 4: Verify the services

Five services make up the appliance. All five should report active:

sudo systemctl is-active nginx php8.3-fpm mariadb dovecot postfix
php -r 'echo "php ".PHP_VERSION."\n";'

Expected output:

active
active
active
active
active
php 8.3.6

Confirm what is actually listening. Only SSH (22) and HTTP (80) are exposed; IMAP (143), SMTP (25) and MariaDB (3306) are all bound to 127.0.0.1:

sudo ss -tlnH | awk '{print $4}' | sort -u

0.0.0.0:22
0.0.0.0:80
127.0.0.1:143
127.0.0.1:25
127.0.0.1:3306

Step 5: Read the first boot credentials

On the first boot of your instance, a one shot service generates a fresh mailbox password, a fresh database password and a fresh des_key encryption key, all unique to that instance, and writes them to a root only file. No cloudimg image ships a shared or default password.

sudo cat /root/roundcube-credentials.txt

Note the roundcube.mail.user (webmail) and the roundcube.mail.pass value — that is your webmail sign in. The screenshot below masks the passwords, which are unique on every instance.

Step 6: Sign in to webmail

Browse to http://<vm-ip>/ and sign in with the webmail user and the password from Step 5.

After signing in you land in the inbox. The folder list (Inbox, Drafts, Sent, Junk, Trash, Archive) is created automatically, and a getting started message from cloudimg is waiting for you.

Open the message to read it in the reading pane. It summarises what is running on the VM and how to repoint Roundcube at your own mail server.

Step 7: Compose a message

Click Compose to open the composer. The From identity is already set to the bundled mailbox, and attachments up to 64 MB are allowed.

Because the bundled Postfix is loopback only, mail addressed to the local mailbox is delivered straight back into Dovecot — useful for verifying the stack end to end. Sending to external recipients requires an outbound relay, which is covered in Step 9.

Set your display name and signature under Settings → Identities:

Step 8: Confirm the security posture

The image ships no known credential and exposes no mail service to the network. You can verify all three properties yourself.

The MTA accepts connections only from the VM itself:

sudo postconf -h inet_interfaces

loopback-only

IMAP authentication is restricted to the virtual mailbox user — Dovecot's system/PAM authentication is disabled, so operating system accounts cannot sign in to webmail:

sudo doveconf -n | grep -E 'driver =' | sed 's/^ *//'

driver = passwd-file
driver = static

And the per instance mailbox credential genuinely authenticates end to end, through the real Roundcube login form into Dovecot IMAP, while blank and weak guesses are rejected:

sudo bash /usr/local/sbin/roundcube-cred-roundtrip.sh

OK per-VM mailbox credential authenticates end-to-end via the Roundcube web login form (-> Dovecot IMAP); blank + weak guesses rejected

Step 9: Point Roundcube at your own mail server

Roundcube speaks standard IMAP and SMTP, so it can front any compliant mail server. Edit two settings in the Roundcube configuration:

sudo nano /var/www/roundcube/config/config.inc.php

Change imap_host and smtp_host to your own servers, for example:

$config['imap_host'] = 'ssl://imap.example.com:993';
$config['smtp_host'] = 'tls://smtp.example.com:587';

Roundcube signs users in against that server with the credentials they type, so also clear the loopback SMTP overrides so it authenticates as the signed in user:

$config['smtp_user'] = '%u';
$config['smtp_pass'] = '%p';

Then reload PHP:

sudo systemctl reload php8.3-fpm

Your users now sign in with their corporate mailbox credentials. The bundled Dovecot and Postfix can be left running (they are loopback only and harmless) or disabled:

sudo systemctl disable --now dovecot postfix

To keep the bundled mailbox but relay outbound mail through an authenticated smarthost instead, configure Postfix's relayhost and SASL credentials rather than changing smtp_host. Contact cloudimg support and we will walk you through it.

Step 10: Verify the data disk

Both the MariaDB datadir and the Dovecot maildir live on a dedicated 20 GiB data disk, so your mail and preferences are kept off the operating system disk and can be snapshotted and resized independently.

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data
findmnt -no SOURCE,TARGET /var/lib/mysql
sudo doveadm mailbox status -u webmail messages INBOX

Expected output:

/dev/sdc /data  ext4   19.5G
/dev/sdc[/mysql] /var/lib/mysql
INBOX messages=1

The MariaDB datadir is a bind mount from /data/mysql onto the canonical /var/lib/mysql path, which keeps AppArmor's default profile valid while still placing the data on the dedicated disk. Mailboxes live under /data/vmail.

Step 11: Enable HTTPS

The image serves HTTP on port 80 so it works immediately on a bare IP. For production, point a DNS record at the instance and issue a certificate:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d mail.your-domain.com

Certbot rewrites the nginx vhost and installs a renewal timer. After enabling HTTPS, tell Roundcube to issue secure cookies by adding this to /var/www/roundcube/config/config.inc.php:

$config['use_https'] = true;

Health endpoint

nginx serves an unauthenticated static health endpoint for Azure Load Balancer probes:

curl -sI http://127.0.0.1/healthz | head -1

HTTP/1.1 200 OK

Maintenance

Roundcube's own database housekeeping runs daily via a systemd timer:

systemctl is-active roundcube-cleandb.timer

Add another mailbox to the bundled Dovecot server by appending a user to the passwd file and creating its maildir:

sudo sh -c 'printf "%s:%s\n" alice "$(doveadm pw -s SHA512-CRYPT)" >> /etc/dovecot/cloudimg-users'
sudo install -d -o vmail -g vmail -m 0700 /data/vmail/alice
sudo systemctl reload dovecot

doveadm pw prompts for the new password and stores only its SHA512-CRYPT hash.

Troubleshooting

The sign in page returns a database error. The first boot service rotates the database password and the Roundcube configuration together. Check that it completed:

systemctl status roundcube-firstboot.service --no-pager
sudo tail -20 /var/log/roundcube-firstboot.log

Sign in is rejected. Confirm the password you are using matches the current mailbox credential:

sudo cat /root/roundcube-credentials.txt

Roundcube reports an IMAP connection error. Check Dovecot is running and that the mailbox authenticates:

sudo systemctl status dovecot --no-pager | head -5

Application errors. Roundcube logs to its own tree, which nginx never serves:

sudo tail -30 /var/www/roundcube/logs/errors.log

Security notes

• No shared or default password ships in the image. The mailbox password, the database password and the des_key used to encrypt stored IMAP session passwords are all generated uniquely on each instance's first boot and written to /root/roundcube-credentials.txt with mode 0600.
• Dovecot's system/PAM authentication is disabled, so only the virtual mailbox user can sign in — operating system accounts cannot access webmail.
• Postfix is bound to loopback-only and can never act as an open relay.
• MariaDB, Dovecot IMAP and Postfix all listen on 127.0.0.1 only. Never open 25, 143, 993 or 3306 on the network security group.
• Roundcube's web installer is removed from the image and enable_installer is false.
• The web root is the public_html directory, so the configuration file holding the database password and des_key sits outside the docroot entirely and is additionally denied by nginx.
• Keep the instance patched with sudo apt-get update && sudo apt-get upgrade. Unattended security upgrades are enabled by default.

Support

cloudimg provides 24/7 technical support for this Roundcube image, including deployment guidance, connecting to external IMAP and SMTP servers, authenticated smarthost and relay setup, TLS certificate installation, plugin and skin configuration, address book and LDAP integration, upgrades and MariaDB administration. Critical issues receive a one hour average response time.

Email support@cloudimg.co.uk.