From iRedMail

THIS UPGRADE TUTORIAL IS A DRAFT, DO NOT APPLY IT.

General

Set strict file permission for Dovecot config files

There're two Dovecot config files are world-readable, we should set strict file owner and permission on them so that it won't leak SQL server infomation.

Please execute below command to fix it, then restart Dovecot service:

• On RHEL/CentOS/Scientific Linux 5.x:

# chown dovecot:dovecot /etc/dovecot-used-quota.conf /etc/dovecot-share-folder.conf
# chmod 0500 /etc/dovecot-used-quota.conf /etc/dovecot-share-folder.conf

• On RHEL/CentOS/Scientific Linux 6.x, Debian, Ubuntu, openSUSE:

# chown dovecot:dovecot /etc/dovecot/dovecot-used-quota.conf /etc/dovecot/dovecot-share-folder.conf
# chmod 0500 /etc/dovecot/dovecot-used-quota.conf /etc/dovecot/dovecot-share-folder.conf

• On FreeBSD:

# chown dovecot:dovecot /usr/local/etc/dovecot-used-quota.conf /usr/local/etc/dovecot-share-folder.conf
# chmod 0500 /usr/local/etc/dovecot-used-quota.conf /usr/local/etc/dovecot-share-folder.conf

Enable case insensitive user authentication in Roundcube webmail

Please change below setting to true in Roundcube webmail config file 'config/main.inc.php' to enable case insensitive user authentication. The config file should be:

• /var/www/roundcubemail/config/main.inc.php on RHEL/CentOS/Scientific Linux
• /usr/share/apache2/roundcubemail/config.inc.php on Debian/Ubuntu
• /srv/www/roundcubemail/config/main.inc.php on openSUSE
• /usr/local/www/roundcubemail/config/main.inc.php on FreeBSD

$rcmail_config['login_lc'] = false;