On Do 10 Jan 2008 08:17:15p Peter Eriksson wrote:

All the suggested ones have just one big FAT problem - they are all written in that security bug ridden language that the hackers just love to exploit - PHP.

Hi,

you could try NeoMail, written in Perl.

http://sourceforge.net/projects/neomail

Bernd

Robert Tomanek wrote:

Hello Peter,

Thursday, January 10, 2008, 8:17:15 PM, you wrote:

...

All the suggested ones have just one big FAT problem - they are all written in that security bug ridden language that the hackers just love to exploit - PHP. Running a web application available to the whole wide internet written in PHP is just asking for someone to break into your systems.

That's pretty much off-topic but for anyone interested just in web mail systems and less so in holy wars & stuff: don't worry, it is not that bad. It is not bad at all, actually :)

OK, let's try to get a bit more on topic and go back to the original question of what's a good webmail client for Dovecot?

We went with Prayer Webmail (written by the University of Cambridge) as it's killer feature was *persistent* IMAP connections.

This mattered hugely when we were using UW-IMAP and opening a mailbox was very expensive in resources. Most of the PHP-based clients such as Squirrelmail are fairly efficient, but still essentially open a new connection for each message read. Some other webmail clients use POP3 (yuck!)

With Dovecot's caching and indexing, things are much better, but there is still a significant overhead on opening lots of connections, I fear, especially for mboxes (moving to maildir would help of course). I would consider using imapproxy (designed to assist with this problem by caching the IMAP connections) but I'm not sure whether it would help significantly.

(Back off topic again :) - Roundcube is an "Ajax" application, which potentially introduces a new class of vulnerabilities. Prayer has a pretty old-fashioned interface, but is written entirely in C and is very efficient in its use of resources. It's probably vulnerable to stored cross-site scripting though, and is no longer actively maintained. Cambridge are now using Cyrus IMAP and are thinking of IMP or Squirrelmail, I think.)

Chris

-- --+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+- Christopher Wakelin, c.d.wakelin@reading.ac.uk IT Services Centre, The University of Reading, Tel: +44 (0)118 378 8439 Whiteknights, Reading, RG6 2AF, UK Fax: +44 (0)118 975 3094

On Thu, 2008-01-10 at 15:19 -0700, Aria Stewart wrote:

...

OK, let's try to get a bit more on topic and go back to the original
question of what's a good webmail client for Dovecot?

We went with Prayer Webmail (written by the University of Cambridge)
as it's killer feature was *persistent* IMAP connections.

Persistence is a total win for webmail. It's among the issues I had
with everything written in PHP.

Right. I've also thought about writing a webmail some day because most of them use non-persistent connections. But maybe not if a usable persistent webmail pops up. :) I was thinking about keeping most of the more complex logic in a Dovecot webmail-plugin and have the actual web interface be pretty dummy.

No-one mentioned WebAlpine yet, which also uses persistent connections. I haven't tried it myself though.

So I wrote my own. http://dinhe.net/~aredridel/projects/ruby/camping-at-the-mailbox

Missing screenshots. :)

Charles Marcus wrote:

On 1/10/2008, Timo Sirainen (tss@iki.fi) wrote:

...

No-one mentioned WebAlpine yet, which also uses persistent connections. I haven't tried it myself though.

I though this is what imapproxy did for webmail? We only have one or two people who actually use ours (Squirrelmail), so it isn't an issue on our dual opteron server, but I've thought about installing it anyway...

Last time I looked at it, imapproxy cached authentication (but so can Dovecot!) but not SELECTs (i.e. opening a mailbox), which is why I wondered how useful it would be.

(BTW www.imapproxy.org doesn't seem to be working at the moment, but the mailing-list archives are at http://lists.andrew.cmu.edu/pipermail/imapproxy-info/)

Chris

-- --+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+- Christopher Wakelin, c.d.wakelin@reading.ac.uk IT Services Centre, The University of Reading, Tel: +44 (0)118 378 8439 Whiteknights, Reading, RG6 2AF, UK Fax: +44 (0)118 975 3094

On Fri, 2008-01-11 at 13:36 +0100, Ralf Hildebrandt wrote:

• Chris Wakelin <c.d.wakelin@reading.ac.uk>:

...

Last time I looked at it, imapproxy cached authentication (but so can Dovecot!) but not SELECTs (i.e. opening a mailbox), which is why I wondered how useful it would be.

## enable_select_cache ## ## This configuration option allows you to turn select caching on or off. ## When select caching is enabled, up-imapproxy will cache SELECT responses ## from an imap server. # enable_select_cache yes

I looked at this code 3 years ago, don't know if it's been changed:

"I'd also advise against using it's SELECT-cache feature (disabled by default), since its design is fundementally broken. It may cause random problems with clients if the same mailbox is opened by multiple clients, or if the mailbox is modified behind up-imapproxy."

On Fri, 2008-01-11 at 06:42 -0500, Charles Marcus wrote:

On 1/10/2008, Timo Sirainen (tss@iki.fi) wrote:

...

No-one mentioned WebAlpine yet, which also uses persistent connections. I haven't tried it myself though.

I though this is what imapproxy did for webmail?

It makes connections look persistent to Dovecot, but it still forgets about its internal state, so it asks everything over and over again all the time. For example:

<request 1> 1 LIST "" * 2 SELECT INBOX 3 FETCH ..stuff.. <request 2> 1 LIST "" * 2 SELECT INBOX 3 FETCH ..hopefully at least other stuff..

And perhaps more importantly, clients with persistent connections and persistent state can use IDLE (or even NOOP) to update its state about new mails, instead of polling them by using commands like "UID SEARCH ALL" or "FETCH 1:* UID".

Il giorno ven, 11/01/2008 alle 06.16 +0200, Timo Sirainen ha scritto:

On Thu, 2008-01-10 at 15:19 -0700, Aria Stewart wrote:

...

...

OK, let's try to get a bit more on topic and go back to the original
question of what's a good webmail client for Dovecot?

We went with Prayer Webmail (written by the University of Cambridge)
as it's killer feature was *persistent* IMAP connections.

Persistence is a total win for webmail. It's among the issues I had
with everything written in PHP.

I use http://freshmeat.net/projects/imapproxy/ for that. works fine.

Marcello Nuccio

On Jan 10, 2008, at 9:16 PM, Timo Sirainen wrote:

...

So I wrote my own. http://dinhe.net/~aredridel/projects/ruby/camping-at-the-mailbox

Missing screenshots. :)

http://dinhe.net/~aredridel/projects/ruby/camping-at-the-mailbox-screenshots

Cheers!

Greetings -

On 10 Jan 2008, at 21:49, Chris Wakelin wrote:

With Dovecot's caching and indexing, things are much better, but
there is still a significant overhead on opening lots of
connections, I fear, especially for mboxes (moving to maildir would
help of course). I would consider using imapproxy (designed to
assist with this problem by caching the IMAP connections) but I'm
not sure whether it would help significantly.

Whatever you do, DON'T move to Maildir if you are using the Prayer
webmail software!

We have used Prayer here for many years with the UW IMAP server
backend and first Berkeley, then later MBX, format mail folders.

When we migrated new users to Dovecoe with Maildir folders we
discovered that Prayer does NOT like Maildir folders. The reason is
that Maildir folders are "dual-purpose": each can contain any mix of
messages and sub-folders. However Prayer is intrinsically designed to
ONLY work with folders that can contain messages or subfolders, but
NOT both. The result is that Prayer can show you the list of folders
to navigate around, but will not list any messages within any folder.

I checked with Cambridge and this is a known and documented
restriction with Prayer. Their solution has been to hack Cyrus to
prevent dual-use folders. (Timo kindly supplied us with a patch for
Dovecot 1.0.x to do likewise.)

We are thinking about moving to a different webmail platform soon, so
I am following this discussion with interest.

I can confirm that webmail software that uses persistent IMAP
connections is a big win: it not only lightens load on the webmail
server machine but also, more importantly, on the IMAP servers.

Cheers, Mike B-)

-- The Computing Service, University of York, Heslington, York Yo10 5DD, UK Tel:+44-1904-433811 FAX:+44-1904-433740

• Unsolicited commercial e-mail is NOT welcome at this e-mail address. *

On 1/11/2008, Mike Brudenell (pmb1@york.ac.uk) wrote:

I can confirm that webmail software that uses persistent IMAP connections is a big win: it not only lightens load on the webmail server machine but also, more importantly, on the IMAP servers.

It doesn't come out and say one way or another, but it *appears* that roundcube may use persistent connections...

http://roundcube.net

Here are a couple of interesting ones I just stumbled on googling:

http://decimail.org/webmail/index

http://sourceforge.net/projects/alphamail

--

Best regards,

Charles

Hi folks,

I'd like to throw in some real world experience: my IMAP server runs for just a few users, but they have huge maildirs (>1GB each) with hundreds of folders and, in some folders, thousands of messages.

Before switching to dovecot, courier-imap handled the backend and I used Squirrelmail as the front-end.

imapproxy had a huge (positive) impact on performance, especially when browsing through folders with many messages. Startup (building the maildir tree with message counts) still took its time, and searching in Squirrelmail also was a pain.

Thanks to Dovecot, startup and search (in from/to, subject) now is really fast and I turned off imapproxy completely as it did not further improve the webmail's performance. I guess in environments where authentication is expensive (slow) imapproxy sure is worth a look at.

Best regards

-hannes

Peter Eriksson wrote:

All the suggested ones have just one big FAT problem - they are all written in that security bug ridden language that the hackers just love to exploit - PHP. Running a web application available to the whole wide internet written in PHP is just asking for someone to break into your systems.

You beat me to it. I was just about to post asking for someone to recommend one NOT written in PHP.

I _really_ _really_ wish someone would write a nice webmail system in some other language... Like a Ruby-on-Rails one (I've found a few, but they aren't actively maintained anymore).

A friend has started writing a Django-based webmail client. It's still very basic, but I see great potential. Especially as it's written in Python, and Django is a very powerful web app framework.

If anyone's interested in chipping in (even just running it and contributing ideas would help) give me a hoi.

-- Curtis Maloney cmaloney@cardgate.net

Stephen Warren wrote:

Peter Eriksson wrote:

...

All the suggested ones have just one big FAT problem - they are all written in that security bug ridden language that the hackers just love to exploit - PHP. Running a web application available to the whole wide internet written in PHP is just asking for someone to break into your systems.

This can be pretty easily solved - configure your web server to require HTTP authentication for the location where the PHP script is, configure the web server to use the same authentication source as webmail, and hack webmail to pick up the authentication from the web server instead of presenting a login prompt.

you also need to enforce strong passwords, because if an attacker can guess passwords, authentication doesn't help much.

In addition, this doesn't solve the problem for hosters, when users cannot be trusted.

Another measure is to enforce https.

That said, it is possible to implement secure applications in php and it is possible to implement unsecure applications in other languages. The fact that php is more widely used than say ruby certainly reduces the costs for attackers, but this doesn't mean that php is unsecure by itself. Also, if you want a "fancy" UI, you'll need javascript and this will bring its problems whatever primary language you use.

Pretty easy with apache and LDAP-based users, and squirrelmail at least...

But, if you don't do this, I totally agree.

On giovedì 10 gennaio 2008, Peter Eriksson wrote:

All the suggested ones have just one big FAT problem - they are all written in that security bug ridden language that the hackers just love to exploit - PHP. Running a web application available to the whole wide internet written in PHP is just asking for someone to break into your systems.

Oh my god! Never heard nothing more ... bah .. no words!

Not to flame, but please permit me to just point out some ideas:

• PHP is one of the many scripting languages
• PHP is oriented to web development (but not only)
• PHP (and PHP4 in particular) had is huge success thanks to its simplicity and the lackness of strict type check and so on...

The last point is the glory and the pain of the language, as this makes unskylled people to rapidly develop in PHP *working* software...

yes, I said "working" software, that is not a good written, projected, hardened software!! Squirrelmail itself is (at least before the OOP recoding) very very poorly written...

Finally, the simple and unconfutable fact that a wide number of web server are exploited thanks to bad PHP script in *not* and intrinsic hole in the language, the are simple very very bad coded script/apps!!!

I can assure that writeing a secure PHP application is not a nightmare, is simply coding in a professional way.

The simple fact of using (using in a professional way, not just installing and coding !!!) a good Framework and ORM can already make the application SQL Injection free, more secure, portable and so on ...

My 2 cents

-- <?php echo ' Emiliano Gabrielli (aka AlberT) ',"\n", ' GrUSP founder - ZCE ',"\n", ' AlberT_at_SuperAlberT_it - www.SuperAlberT.it ',"\n", ' IRC: #php,#AES azzurra.com ',"\n",'ICQ: 158591185'; ?>

Charles Marcus wrote:

On 1/10/2008, Robert Tomanek (dovecot@mail.robert.tomanek.org) wrote:

...

I can confirm RoundCube ( http://www.roundcube.net/ ) is a good recommendation.

Can you confirm that it uses persistent IMAP connections? I can't tell from the website or searching the mail archives or forum...

In my limited testing with a recent SVN build (http://nightly.roundcube.net/trunk/roundcubemail-trunk-r938-20071210.tgz from Dec 10th), it doesn't use persistent connections, but apparently it does cache stuff in its MySQL database, which will help somewhat.

It *does* tell the user about new mail which is a nice feature that Prayer hasn't got!

Chris

-- --+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+- Christopher Wakelin, c.d.wakelin@reading.ac.uk IT Services Centre, The University of Reading, Tel: +44 (0)118 378 8439 Whiteknights, Reading, RG6 2AF, UK Fax: +44 (0)118 975 3094

Hi,

On 11/01/2008, Udo Rader <udo.rader@bestsolution.at> wrote:

We have been testing roundcube for couple of weeks now and although it is simple, fast and "reasonably" structured internally, it is still too buggy for us (eg. problems with special characters in mails) or lacks important features (eg. like import/export functionality for address books) for a large scale deployment.

I did actually write a little extension to RC mail myself about a month ago - which you could try. http://www.rmacd.com/downloads/howto/add-csv-to-roundcube.php

Kind regards, Ronald.

-- Ronald MacDonald http://www.rmacd.com/ 0777 235 1655

On 22:19:16 2008-01-10 Thomas Løcke <thomas@loecke.dk> wrote:

Peter Sparkes wrote:

...

Hi,

I want to install webmail. I am using Dovecot with Exim4.

Recommendations requested please.

Thanks

Peter Sparkes

http://hastymail.sourceforge.net/

Hastymail is very light, fast and extremely easy to setup and maintain. I can highly recommend it.

Seconded... It is a great simple webmail client and it's nearly how I'd like to have a console client as well :)

-- Andraž "ruskie" Levstik Source Mage GNU/Linux Games grimoire guru Geek/Hacker/Tinker

Be sure brain is in gear before engaging mouth.

Key id = F4C1F89C Key fingerprint = 6FF2 8F20 4C9D DB36 B5B6 F134 884D 72CC F4C1 F89C

On giovedì 10 gennaio 2008, Andreas Schneider wrote:

It is the best webmailer I've found. You give it a try.

I do not agree sorry, I found horde a very huge collaboration framework and IMP (the hosrde webmail component) is too much bounded to the rest of the framework ... I think that if you need only a webmail horde is too much ...

.. moreover I found its UI too much hard to completely customize. There was not (at least when I tried it) a good MVC architecture.

The best would be to find a WM basedon a good modern MVC framework, such as (spoking about the PHP world) symfony of Zend FW).. but I don't know if such a kimera exists :)

-- <?php echo ' Emiliano Gabrielli (aka AlberT) ',"\n", ' GrUSP founder - ZCE ',"\n", ' AlberT_at_SuperAlberT_it - www.SuperAlberT.it ',"\n", ' IRC: #php,#AES azzurra.com ',"\n",'ICQ: 158591185'; ?>

Tim Alberts wrote:

I'll add Usermin (http://webmin.com/usermin.html) to the list, which is part of the webmin (http://webmin.com/) program. It's more than just a web based email client, but you can limit features that you don't want users to access.

Out of curiosity, I Yahood 'java mbox maildir' and found a nice list here:

http://java.sun.com/products/javamail/Third_Party.html

May have to look at some of these myself.