Install Roundcube on Debian/Ubuntu: Package Setup with Apache

This article is a localized edition of the Japanese original. Read the Japanese original

Roundcube is an open-source webmail client that lets you read and write mail in an IMAP mailbox from a browser. Debian and Ubuntu ship a roundcube package, and installing it with apt also creates the database and puts the Apache configuration files in place. Security fixes arrive as regular OS updates, so it suits setups where you want an easy install and long-term operation.

This article uses the roundcube package in Debian 13 (1.6.20 as of November 2026) and runs it with MariaDB and Apache. Ubuntu has a package with the same name and the steps are almost the same (the version differs by Ubuntu release). For running the release tarball from the official site on Nginx, see How to build a webmail client with Roundcube.

Before you start

Roundcube does not store mail itself. It connects to an IMAP server (such as Dovecot) to display mail and to an SMTP server (such as Postfix) to send it. The following must already be in place.

• A mail app can receive over IMAP and send with authentication over SMTP (port 587).
• The DNS for the host name you will publish webmail on (for example webmail.example.com) points to this server.
• You can install packages with administrator rights (sudo).

If you do not have a mail server yet, first follow Building an IMAP mail server with Postfix and Dovecot.

Step 1: Install the database and web server

The Roundcube package creates its database during installation. So install and start MariaDB first. Install Apache and PHP at the same time.

sudo apt update
sudo apt install mariadb-server apache2 libapache2-mod-php
sudo systemctl status mariadb --no-pager

Once MariaDB shows active (running), continue.

Step 2: Install the roundcube package

sudo apt install roundcube roundcube-mysql roundcube-plugins

During installation you are asked whether to configure the database with dbconfig-common. If you answer "Yes", a database named roundcube and a user of the same name are created in the local MariaDB, along with the tables. If you leave the user password blank, one is generated automatically.

The following are created.

If you skipped the database setup or want to redo the configuration, this command shows the questions again.

sudo dpkg-reconfigure roundcube-core

Step 3: Set the IMAP and SMTP servers

Open /etc/roundcube/config.inc.php. Right after the package is installed, the servers are set as follows.

$config['imap_host'] = ["localhost:143"];
$config['smtp_host'] = 'localhost:587';
$config['smtp_user'] = '%u';
$config['smtp_pass'] = '%p';

The %u and %p in smtp_user and smtp_pass mean that SMTP authentication uses the username and password you logged in to Roundcube with.

If you point to the host name in the mail server's certificate and connect with encryption, the same settings keep working if you later move Roundcube to another server.

// IMAP on port 993 (TLS from the start), SMTP on port 587 (STARTTLS)
$config['imap_host'] = 'ssl://mail.example.com:993';
$config['smtp_host'] = 'tls://mail.example.com:587';
$config['smtp_user'] = '%u';
$config['smtp_pass'] = '%p';

$config['product_name'] = 'Webmail';
$config['plugins'] = ['archive', 'zipdownload'];

• ssl:// means TLS from the moment you connect; tls:// means connecting in plain text and then encrypting with STARTTLS.
• If you use an IP address, it does not match the host name in the certificate and TLS verification fails.
• imap_host and smtp_host are the option names in the 1.6 series. default_host, smtp_server and a main.inc.php configuration file, seen in older guides, are not used in current versions.
• des_key (the key that encrypts the password during a session) is set to a random value by the package at install time. You do not need to change it.

Because the configuration file contains the database password and other secrets, the package sets its owner to root, its group to www-data and its permissions to 640. Leave them as they are.

Roundcube is a PHP application and has no resident service. Changes to the configuration file take effect the next time a page is opened.

Step 4: Publish with Apache

In the /etc/roundcube/apache.conf file installed by the package, the Alias line that publishes Roundcube at /roundcube is commented out. There are two ways to publish it.

Option A: Publish on a dedicated webmail host name (recommended)

Prepare a dedicated host name such as webmail.example.com and point its document root to /var/lib/roundcube/public_html. This keeps the configuration and log directories out of web reach.

Create /etc/apache2/sites-available/webmail.conf.

<VirtualHost *:80>
    ServerName webmail.example.com
    DocumentRoot /var/lib/roundcube/public_html

    ErrorLog ${APACHE_LOG_DIR}/webmail_error.log
    CustomLog ${APACHE_LOG_DIR}/webmail_access.log combined
</VirtualHost>

Enable it and get a Let's Encrypt certificate. The certbot Apache plugin adds the HTTPS configuration and can also set up the redirect from HTTP to HTTPS.

sudo a2ensite webmail
sudo apache2ctl configtest
sudo systemctl reload apache2

sudo apt install certbot python3-certbot-apache
sudo certbot --apache -d webmail.example.com

Directory access permissions and the setting that reads .htaccess (AllowOverride All) are already in /etc/roundcube/apache.conf, so you do not need to add them to the virtual host.

Option B: Publish at /roundcube on an existing site

Remove the leading # from the following line in /etc/roundcube/apache.conf and reload Apache.

    Alias /roundcube /var/lib/roundcube/public_html

sudo apache2ctl configtest
sudo systemctl reload apache2

This Alias applies to every virtual host on the server. If WordPress or other sites run on the same server, webmail opens at /roundcube on every domain, so Option A is easier to manage.

Step 5: Log in and check

Open https://webmail.example.com/ in a browser (https://example.com/roundcube/ for Option B) and log in with your email address (or the username configured in Dovecot) and password. Check these three things.

1. The inbox appears and you can open folders (Sent, Trash and so on).
2. You can send a message to yourself and receive it.
3. You can send a message with an attachment.

To check from the command line, confirm that the login screen returns 200 and the configuration file returns 404.

curl -s -o /dev/null -w "%{http_code}\n" https://webmail.example.com/
curl -s -o /dev/null -w "%{http_code}\n" https://webmail.example.com/config/config.inc.php

Troubleshooting checklist

A PHP syntax check finds typos in the configuration file.

sudo php -l /etc/roundcube/config.inc.php

Operation and security after going live

• Keep updating: Roundcube exposes a login screen on the web, and vulnerabilities that were exploited in real attacks have been reported in the past. If you installed it from the Debian/Ubuntu package, sudo apt update && sudo apt upgrade applies security fixes, and dbconfig-common also updates the database tables. Automatic updates (unattended-upgrades) reduce the chance of missing a fix.
• Brute-force protection: fail2ban has a Roundcube jail (roundcube-auth), and in the Debian package its log path is already set to /var/log/roundcube/errors.log. Add the following to /etc/fail2ban/jail.local and restart fail2ban to block IP addresses that repeatedly fail to log in. Block authentication failures on Dovecot and Postfix as well.

[roundcube-auth]
enabled = true

• Restrict access: If only your organization uses it, limiting where connections come from with Apache's Require ip or a VPN greatly reduces the attack surface.
• On the same server as WordPress: Publish Roundcube on its own host name (Option A) and keep its database separate from WordPress (using the roundcube database and user the package creates keeps them separate).
• Scheduled maintenance: Cleanup of old sessions and caches is handled by the systemd timers the package installs (roundcube-gc.timer, roundcube-cleandb.timer). You do not need to add your own cron jobs.

Summary

• On Debian and Ubuntu you can install it with the roundcube package. If MariaDB is running first, dbconfig-common creates the database and user automatically.
• In /etc/roundcube/config.inc.php, set imap_host and smtp_host to match the certificate host name and the encryption method.
• For publishing, a dedicated host name with its document root at /var/lib/roundcube/public_html is recommended.
• Roundcube has no resident service, and you update it with apt. Use fail2ban and access restrictions to protect the login screen from attacks.

Related articles

• How to build a webmail client with Roundcube (adding it to Postfix and Dovecot, publishing it safely)
• Building an IMAP mail server with Postfix and Dovecot
• Protecting Postfix and Dovecot from unauthorized access with fail2ban

References: Roundcube official site, Roundcube configuration options (GitHub Wiki), Debian roundcube packages

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)