Roundcube

Five services make up the appliance. All five should report active:

sudo systemctl is-active nginx php8.3-fpm mariadb dovecot postfix php -r 'echo "php ".PHP_VERSION."\n";'

The expected output is:

active active active active active php 8.3.6

Confirm what is actually listening. Only SSH (22) and HTTP (80) are exposed. IMAP (143), SMTP (25) and MariaDB (3306) are all bound to 127.0.0.1:

sudo ss -tlnH | awk '{print $4}' | sort -u

0.0.0.0:22 0.0.0.0:80 127.0.0.1:143 127.0.0.1:25 127.0.0.1:3306

On the first boot of your instance, a one-shot service generates a fresh mailbox password, a fresh database password and a fresh des_key encryption key, all unique to that instance, and writes them to a root-only file. No SecureAnyCloud image ships a shared or default password.

Print the file:

sudo cat /root/roundcube-credentials.txt

Note the roundcube.mail.user (webmail) and the roundcube.mail.pass value. Together they are your webmail sign-in. The passwords are unique on every instance.

Browse to http://<vm-ip>/ and sign in with the webmail user and the password from Step 5.

After you sign in, you land in the inbox. The folder list (Inbox, Drafts, Sent, Junk, Trash, Archive) is created automatically, and a getting-started message from SecureAnyCloud is waiting for you.

Open the message to read it in the reading pane. It summarises what is running on the VM and how to repoint Roundcube at your own mail server.

Choose Compose to open the composer. The From identity is already set to the bundled mailbox, and attachments up to 64 MB are allowed.

Because the bundled Postfix is loopback-only, mail addressed to the local mailbox is delivered straight back into Dovecot, which is useful for verifying the stack end to end. Sending to external recipients requires an outbound relay, which is covered in Step 9.

Set your display name and signature under Settings, then Identities.

The image ships no known credential and exposes no mail service to the network. You can verify all three properties yourself.

First, the MTA accepts connections only from the VM itself:

sudo postconf -h inet_interfaces

loopback-only

Second, IMAP authentication is restricted to the virtual mailbox user. Dovecot's system and PAM authentication is disabled, so operating system accounts cannot sign in to webmail:

sudo doveconf -n | grep -E 'driver =' | sed 's/^ *//'

driver = passwd-file driver = static

Third, the per-instance mailbox credential authenticates end to end, through the real Roundcube login form into Dovecot IMAP, while blank and weak guesses are rejected:

sudo bash /usr/local/sbin/roundcube-cred-roundtrip.sh

OK per-VM mailbox credential authenticates end-to-end via the Roundcube web login form (-> Dovecot IMAP); blank + weak guesses rejected

Roundcube speaks standard IMAP and SMTP, so it can front any compliant mail server. Edit two settings in the Roundcube configuration:

sudo nano /var/www/roundcube/config/config.inc.php

Change imap_host and smtp_host to your own servers, for example:

$config['imap_host'] = 'ssl://imap.example.com:993'; $config['smtp_host'] = 'tls://smtp.example.com:587';

Roundcube signs users in against that server with the credentials they type, so also clear the loopback SMTP overrides. This makes Roundcube authenticate as the signed-in user:

$config['smtp_user'] = '%u'; $config['smtp_pass'] = '%p';

Then reload PHP:

sudo systemctl reload php8.3-fpm

Your users now sign in with their corporate mailbox credentials. You can leave the bundled Dovecot and Postfix running, because they are loopback-only and harmless, or disable them:

sudo systemctl disable --now dovecot postfix

To keep the bundled mailbox but relay outbound mail through an authenticated smarthost instead, configure Postfix's relayhost and SASL credentials rather than changing smtp_host. Contact SecureAnyCloud support and we will walk you through it.

Both the MariaDB datadir and the Dovecot maildir live on a dedicated 20 GiB data disk. Your mail and preferences are therefore kept off the operating system disk and can be snapshotted and resized independently. Verify the mounts:

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data
findmnt -no SOURCE,TARGET /var/lib/mysql
sudo doveadm mailbox status -u webmail messages INBOX

The expected output is:

/dev/sdc /data ext4 19.5G /dev/sdc[/mysql] /var/lib/mysql INBOX messages=1

The MariaDB datadir is a bind mount from /data/mysql onto the canonical /var/lib/mysql path. This keeps AppArmor's default profile valid while still placing the data on the dedicated disk. Mailboxes live under /data/vmail.

The image serves HTTP on port 80, so it works immediately on a bare IP. To serve webmail over HTTPS, point a DNS record at the instance and issue a certificate:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d mail.your-domain.com

Certbot rewrites the nginx vhost and installs a renewal timer. After you enable HTTPS, tell Roundcube to issue secure cookies by adding this to /var/www/roundcube/config/config.inc.php:

$config['use_https'] = true;

Launch the image from AWS Marketplace, then connect to the instance over SSH. The login user depends on the AMI variant you launched:

• OS variant: Ubuntu 24.04
• SSH login user: ubuntu
• Connect with: ssh -i your-key.pem ubuntu@<public-ip>

Five services make up the appliance. All five should report active:

sudo systemctl is-active nginx php8.3-fpm mariadb dovecot postfix php -r 'echo "php ".PHP_VERSION."\n";'

The expected output is:

active active active active active php 8.3.6

Confirm what is actually listening. Only SSH (22) and HTTP (80) are exposed. IMAP (143), SMTP (25) and MariaDB (3306) are all bound to 127.0.0.1:

sudo ss -tlnH | awk '{print $4}' | sort -u

0.0.0.0:22 0.0.0.0:80 127.0.0.1:143 127.0.0.1:25 127.0.0.1:3306 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:80

On the first boot of your instance, a one-shot service generates a fresh mailbox password, a fresh database password, a fresh database maintenance password and a fresh des_key encryption key, all unique to that instance, and writes them to a root-only file. No SecureAnyCloud image ships a shared or default password.

The credentials file holds real secrets, so read only the value you need rather than printing the whole file. List the keys it contains:

sudo grep -oE '^[a-z.]+=' /root/roundcube-credentials.txt

roundcube.url= roundcube.mail.user= roundcube.mail.pass= roundcube.mail.address= roundcube.db.name= roundcube.db.user= roundcube.db.pass=

When you are ready to sign in, read the mailbox username and then the mailbox password:

sudo grep '^roundcube.mail.user=' /root/roundcube-credentials.txt | cut -d= -f2-

webmail

sudo grep '^roundcube.mail.pass=' /root/roundcube-credentials.txt | cut -d= -f2-

<ROUNDCUBE_MAIL_PASSWORD>

Browse to http://<public-ip>/ and sign in with the webmail user and the password from Step 3.

After you sign in, you land in the inbox. The folder list (Inbox, Drafts, Sent, Junk, Trash, Archive) is created automatically, and a getting-started message from SecureAnyCloud is waiting for you.

Open the message to read it in the reading pane. It summarises what is running on the instance, the outbound mail position, and how to repoint Roundcube at your own mail server.

Choose Compose to open the composer. The From identity is already set to the bundled mailbox, and attachments up to 64 MB are allowed.

The bundled Postfix is loopback-only and has no relay configured. Mail addressed to the local mailbox is delivered straight back into Dovecot, which is a quick way to verify the stack end to end. Mail addressed to an external recipient will not be delivered until you configure a relay, which is Step 9.

Set your display name and signature under Settings, then Identities.

The image ships no known credential and exposes no mail service to the network. You can verify each property yourself.

First, the MTA accepts connections only from the instance itself, trusts only the loopback network, and ends its relay rules with reject_unauth_destination:

sudo postconf -h inet_interfaces
sudo postconf -h mynetworks
sudo postconf -h smtpd_relay_restrictions

loopback-only 127.0.0.0/8 permit_mynetworks, reject_unauth_destination

This is what makes it impossible to use this instance as an open relay. An open relay is an MTA that accepts mail from arbitrary remote clients, and nothing remote can reach this one.

Prove it by trying to open the SMTP port on the instance's own private address. The connection is refused, while the loopback answers:

PRIV=$(hostname -I | awk '{print $1}') timeout 5 bash -c "exec 3<>/dev/tcp/${PRIV}/25" && echo "REACHABLE - unexpected" || echo "refused on ${PRIV}:25 as expected" timeout 5 bash -c 'exec 3<>/dev/tcp/127.0.0.1/25; head -1 <&3'

refused on 172.31.83.124:25 as expected 220 localhost.localdomain ESMTP

Second, IMAP authentication is restricted to the virtual mailbox user. Dovecot's system and PAM authentication is disabled, so operating system accounts cannot sign in to webmail:

sudo doveconf -n | grep -E 'driver =' | sed 's/^ *//'

driver = passwd-file driver = static

Third, the per-instance mailbox credential authenticates end to end, through the real Roundcube login form into Dovecot IMAP, while blank and weak guesses are rejected:

sudo bash /usr/local/sbin/roundcube-cred-roundtrip.sh

OK per-instance mailbox credential authenticates end-to-end via the Roundcube web login form (-> Dovecot IMAP); blank + weak guesses rejected

The MariaDB datadir and the Dovecot mail store are on separate EBS volumes, both mounted by filesystem UUID. Your mail and your preferences are therefore kept off the operating system disk and can be snapshotted and resized independently. Mail grows without bound, which is why it gets its own volume.

Verify the mounts:

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /var/lib/mysql
findmnt -no SOURCE,TARGET,FSTYPE,SIZE /var/vmail
sudo doveadm mailbox status -u webmail messages INBOX

The expected output is:

/dev/nvme1n1 /var/lib/mysql ext4 19.5G /dev/nvme2n1 /var/vmail ext4 29.4G INBOX messages=1

To grow either tier, modify the EBS volume in the AWS console, then extend the filesystem in place with sudo resize2fs <device>. Neither operation needs downtime.

nginx serves an unauthenticated static health endpoint suitable for an Application Load Balancer or Network Load Balancer target group health check. Check it:

curl -sI http://127.0.0.1/healthz | head -1

HTTP/1.1 200 OK

This is the step most deployments need, so read it carefully.

Why the default does not send externally. Three separate things stand in the way, and none of them is something an AMI can fix for you:

• Port 25 is throttled. AWS rate-limits outbound TCP port 25 from EC2 by default. You remove that limit by submitting the Request to remove email sending limitations form from the AWS Support Center, which also lets you associate a reverse DNS record with the instance's Elastic IP.
• No reverse DNS and no reputation. A brand-new EC2 address has no PTR record and no sending history. Most large receivers reject or junk mail from such addresses regardless of port 25 access.
• No SPF or DKIM. Without published SPF and DKIM records that authorise your sender, receivers cannot verify that the mail is really from your domain.

The supported approach is an authenticated relay. Amazon SES is the usual choice on AWS. It handles reputation, DKIM signing and deliverability reporting, and it accepts submissions on port 587, which is not throttled.

To set it up, create SES SMTP credentials in the SES console, verify your sending domain, and publish the SPF and DKIM records that SES gives you. Then point Postfix at SES as a smarthost, using your SES SMTP credentials and the SES endpoint for your region. SecureAnyCloud support will walk you through the Postfix relayhost and SASL configuration for your account and region.

Alternatively, do not send from this instance at all. If your users already have mailboxes on a corporate mail server, Step 10 repoints Roundcube at it, and outbound mail leaves through that server instead. For many deployments, that is the simplest answer.

Roundcube speaks standard IMAP and SMTP, so it can front any compliant mail server. Edit two settings in the Roundcube configuration file, /var/www/roundcube/config/config.inc.php:

• IMAP server: $config['imap_host']
• SMTP server: $config['smtp_host']

Open the file with your editor of choice and set them to your own servers, for example:

$config['imap_host'] = 'ssl://imap.example.com:993'; $config['smtp_host'] = 'tls://smtp.example.com:587';

Roundcube signs users in against that server with the credentials they type, so also set the SMTP overrides. These make Roundcube authenticate as the signed-in user rather than as the loopback:

$config['smtp_user'] = '%u'; $config['smtp_pass'] = '%p';

Then reload PHP:

sudo systemctl reload php8.3-fpm

Your users now sign in with their corporate mailbox credentials. You can leave the bundled Dovecot and Postfix running, because they are loopback-only and harmless.

If you would rather turn them off once you no longer need the bundled mailbox, run sudo systemctl disable --now dovecot postfix. This stops local delivery, so the bundled webmail mailbox and the credential round-trip check in Step 6 no longer work afterwards.

The image serves HTTP on port 80, so it works immediately on a bare IP. To serve webmail over HTTPS, point a DNS record at the instance and issue a certificate:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d mail.your-domain.com

Certbot rewrites the nginx vhost and installs a renewal timer. After you enable HTTPS, tell Roundcube to issue secure cookies by adding this to /var/www/roundcube/config/config.inc.php:

$config['use_https'] = true;