More global cleanup. Now all SESSION and COOKIE use sqgetglobalvar, what's

[squirrelmail.git] / INSTALL

Installing SquirrelMail
=======================

Table of Contents:
  1.  (PHP4)     Configure your webserver to work with PHP4
  2.  (IMAP)     Setting up IMAP (not covered)
  3.  (INSTALL)  Obtaining and installing SquirrelMail
  4.  (RUN)      Running SquirrelMail
  5.  (CHARSETS) Russian Charsets




1. CONFIGURE YOUR WEBSERVER TO WORK WITH PHP4
---------------------------------------------

  If your webserver does not already have PHP4 you must configure it
  to work with PHP4. SquirrelMail uses the standard suffix .php for
  all PHP4 files. This is a quick and dirty guide to installing PHP4
  to run as CGI under Apache. How you end up doing this is up to you
  (your mileage may vary).

  You will need at least PHP v4.0.6. If you need to upgrade please go
  ahead and install it now.

a. Obtaining and compiling PHP4
  
  SquirrelMail has not been tested for use with PHP 4.3.x.  The
  development team does not recommend the use of this software with
  PHP 4.3.x until further testing can be done.

  Point your favorite webserver at http://www.php.net/version4/ and
  download the source. Untar (tar xvfz filename-you-downloaded.tgz)
  the source, cd into the directory and run configure. To make PHP4
  work with SquirrelMail a commandline like this should do:

   ./configure --enable-track-vars --enable-force-cgi-redirect --with-gettext

  If you have a database like MySQL you might want to add something
  like --with-mysql to get database functionality.

  If you're going to use LDAP in the addressbook, you must compile PHP4
  with --with-ldap (see the PHP4 docs for more information).

  Run make to build the binary file. This will generate a binary file
  called "php". Move this file into a CGI-directory.

  You might also want to read the INSTALL file in the PHP-distribution
  :-)

b. Changing php.ini

  PHP defaults to look for php.ini (PHP's configuration file) in
  /usr/local/lib.  However, for security reasons, it is suggested
  that the location of this file is changed to someplace else.  This
  can be done at configure time with the configuration directive
  --with-config-file-path=PATH.

  Edit the php.ini file and make sure session.use_cookies is 1.  Also 
  be sure to change the session.save_path to someplace that can only 
  be read and written to by the webserver.  session.save_path is the
  location that PHP's session data will be written to.

  SECURITY WARNING - If a user has access to write PHP scripts on your 
  system and knows the location where PHP stores session data, he 
  could get a listing of the sessions being used and then read a given 
  session's data with his own PHP script.  Caution should be used when 
  setting up permissions and locations of php.ini and the session data.

  FILE UPLOADS - Note that sending attachments will not work if your
  "file_uploads" setting is "Off". Squirrelmail requires that setting
  enabled in order to be able to attach files.

c. Setting up .php files to use PHP4

  You need to create a .htaccess file in you SquirrelMail directory
  that looks something like this:

    AddType application/php4script .php
    Action application/php4script /cgi-bin/php

  You could also add these lines to your Apache configuration file.

d. Running into trouble

  Setting up Apache with PHP4 can be a non-trivial task. Read the PHP4
  and Apache documentation carefully if you run into trouble. If you
  have an experienced system administrator around ask her/him to help
  you.

2. SETTING UP IMAP
------------------

  This is not covered here :-/

3. OBTAINING AND INSTALLING SQUIRRELMAIL
----------------------------------------

  SquirrelMail is still under development. Therefore you should always
  get the newest version around. Look at
  http://www.squirrelmail.org/index.php3?page=5 to see what it
  is. If you want to be bleeding edge you might want to consider using
  the latest CVS version (with the latest and most fashionable of
  bugs).

a. Download SquirrelMail

  Get SquirrelMail from the address above if you do not have it or are
  uncertain if you have the newest version. Untar (again tar xvfz
  filename.tgz) SquirrelMail in a directory that is readable for your
  webserver.

b. Setting up directories

  SquirrelMail uses two directories to store user configuration and
  attachments that are about to be sent. You might want to have these
  directories outside of your web tree.

  The data directory is used for storing user preferences, like
  signature, name and theme. When unpacking the sources this directory
  is created as data/ in your SquirrelMail directory. This directory
  must be writable by the webserver. If your webserver is running as
  the user "nobody" you can fix this by running:

    $ chown -R nobody data
    $ chgrp -R nobody data

  Keep in mind that with different installations, the web server could
  typically run as userid/groupid of nobody/nobody, nobody/nogroup, 
  apache/apache or www-data/www-data.  The best way to find out is to read 
  the web server's configuration file.

  There also needs to be a directory where attachments are stored
  before they are sent. Since personal mail is stored in this
  directory you might want to be a bit careful about how you set it
  up. It should be owned by another user than the webserver is running
  as (root might be a good choice) and the webserver should have write
  and execute permissions on the directory, but should not have read
  permissions. You could do this by running these commands (still
  granted that the webserver is running as nobody/nobody)

    $ cd /var/some/place
    $ mkdir SomeDirectory
    $ chgrp -R nobody SomeDirectory
    $ chmod 730 SomeDirectory

  If you trust all the users on you system not to read mail they are
  not supposed to read change the last line to chmod 777 SomeDirectory
  or simply use /tmp as you attachments directory. 
  
  If a user is aborting a mail but has uploaded some attachments to it 
  the files will be lying around in this directory forever if you do not 
  remove them.  To fix this, it is recommended to create a cron job that
  deletes everything in the attachment directory.  Something similar
  to the following will be good enough:

    $ cd /var/attach/directory
    $ rm -f *
    
  However, this will delete attachments that are currently in use by people
  sending email when the cron job runs.  You can either (1) make sure that
  the cron job runs at an obscure hour and hope that nobody gets upset, or
  (2) you can run a modified version of the commands above.  Check out the
  man pages for other commands such as 'find' or 'tmpreaper'.
  
  One sample script you could set up that would erase all attachments, but
  wouldn't erase preferences, address books, or the like (just in case your
  attachment directory is the same as your data directory) might look like 
  this:
   
    $ rm `find /var/attach/directory -atime +2 | grep -v "\." | grep -v _`
    
  Remember to be careful with whatever method you do use, and to test out
  the command before it potentially wipes out everyone's preferences.

c. Setting up SquirrelMail

  There are two ways to configure Squirrelmail.  In the config/ directory,
  there is a perl script called conf.pl that will aid you in the
  configuration process.  This is the recommended way of handling
  the config.

  You can also copy the config/config_default.php file to config/config.php
  and edit that manually.

4. RUNNING SQUIRRELMAIL
-----------------------

  Point your browser at the URL at which SquirrelMail is installed.  A
  possible example of this is: 
     http://www.yourdomain.com/squirrelmail
     
  It should be pretty straight forward to use. Some more documentation
  might show up one day or another.


5. RUSSIAN CHARSETS
-------------------

  For information on how to make SquirrelMail work with Russian
  Apache, see the README.russian_apache in the doc/ subdirectory.