WARNING!!! Horde Framework: Multiple XSS vulnerabilities
*Credits:
The HOWTO is a rewrite of the Horde modules guide found here: http://www.totkat.org/
Thanks to relkai for providing the Horde and IMP section.
*Notes:
If you already have followed the Virtual Mail Hosting System Guide and have MySQL + Horde IMP installed and configured you can skip the Horde and IMP section in Part 1 and continue from Part 2 - Creating a horde database -.
There is no explanation on how to install and configure MySQL in this guide yet, so you need to do a search in the forums on how to do this. (This will hopfully be added later)
Adding the use flags: cli, session and xml to your system might be a good idea to avoid having to rebuild php multiple times. (Thanks spencerogden)
$DOCROOT = your path to horde. Mine is /var/www/localhost/htdocs/horde. Replace $DOCROOT with your path to the horde directory.
My editor of choice is nano, replace nano with the editor you use in the code sections.
Part 1
- Installing Horde -
Emerge horde and rename the config files from foo.php.dist to foo.php:
Code: Select all
emerge -a horde
cd $DOCROOT/config
for f in *.dist ; do mv ${f} ${f/.dist} ; doneEmerge IMP and rename the config files from foo.php.dist to foo.php:
Code: Select all
emerge -a horde-imp
cd $DOCROOT/imp/config
for f in *.dist ; do mv ${f} ${f/.dist} ; doneCode: Select all
nano -w conf.phpFor example, if you want to see turba, kronolith and mnemo in that order, edit line 37 to look like this:
The part below this line is the default configuration of every account.$conf['menu']['apps'] = array('turba','kronolith','mnemo');
You can set permissions and defaults here. Because it's up to the sysadmin what he wants to allow or disallow, it's unnecessary to write down my configuration.
The most of these options are accessable over the webinterface so for a first test you can leave them as they are and change them later to fit your needs.
More default configurations and permissions can be found in "prefs.php".
Some of them are server or region specific - the most important ones are:
- line 245: sent folder name
- line 261: use of imap folder subscriptions
- line 277: default language
- line 293: default timezone
- line 400: trash folder name
- line 653: drafts folder name
The most of this file can be left as it is and you can do the fine tuning at a later time. If you're using the webmail interface, you'll see what you want to allow or disallow.
If you like to see HTML messages within the webinterface, edit line 63 in the file mime_drivers.php to look like this:
Code: Select all
nano -w mime_drivers.phpNow it's time to configure the mail server we're connecting to.$mime_drivers['imp']['html']['inline'] = true;
Code: Select all
nano -w servers.phpReplace [domain] with your mail domain.$servers['imap'] = array(
'name' => 'IMAP Server',
'server' => 'localhost',
'protocol' => 'imap/ssl/novalidate-cert',
'port' => 993,
'folders' => 'INBOX.',
'namespace' => '',
'maildomain' => '[domain]',
'smtphost' => 'localhost',
'realm' => '',
'preferred' => ''
);
I commented everything below this block, so I don't use any other server connections.
Of course it depends on your mail server configuration, what you have to fill in here.
Some example server connections are placed into this file.
Activate IMP in the horde registry.php:
Code: Select all
nano $DOCROOT/config/registry.phpIf you use IMAP and want to prevent the "double login effect" by accessing your webmail, you may want to authenticate to horde against your IMAP accounts instead of horde's own mechanism.$this->applications['imp'] = array(
'fileroot' => dirname(__FILE__) . '/../imp',
'webroot' => $this->applications['horde']['webroot'] . '/imp',
'icon' => $this->applications['horde']['webroot'] . '/imp/graphics/imp.gif',
'name' => _("Mail"),
'allow_guests' => false,
'status' => 'active'
);
To configure it, you only have to comment out lines 23 and 24 in the registry.php:
To activate the automatic adressbook lookup in IMP edit the prefs.php file:$this->registry['auth']['login'] = 'imp';
$this->registry['auth']['logout'] = 'imp';
Code: Select all
nano -w $DOCROOT/imp/config/prefs.php
Part 2// addressbook(s) to use when expanding addresses
// You can provide default values this way (note the \t and the double quotes):
// 'value' => "source_one\tsource_two"
// refer to turba/config/sources.php for possible source values
$_prefs['search_sources'] = array(
'value' => 'localsql',
'locked' => true,
'shared' => false,
'type' => 'implicit'
);
// field(s) to use when expanding addresses
// This depends on the search_sources preference if you want to provide default values:
// 'value' => "source_one\tfield_one\tfield_two\nsource_two\tfield_three"
// will search the fields 'field_one' and 'field_two' in source_one and
// 'field_three' in source_two.
// refer to turba/config/sources.php for possible source and field values
$_prefs['search_fields'] = array(
'value' => 'localsql\tname\temail',
'locked' => false,
'shared' => false,
'type' => 'implicit'
);
The next steps the guide will cover the installation of these Horde modules: Turba (Address Book), Kronolith (Calendar Application), Mnemo (Memos and Notes) & Passwd (Password changing Application)
You don't have to install all the modules if there are one or more you feel you don't need. You must however do the first step and create a horde database in MySQL regardless of which module(s) you choose to install.
(Except for Passwd since it uses the vpopmail database.)
- Creating a horde database -
First we need to setup a 'horde' database in MySQL. Horde provides a handy script for this, so all you need to do is edit the password in this script and then import it in MySQL. (The database will be called horde and the username will also be horde.)
Code: Select all
cd $DOCROOT/scripts/db
nano mysql_create.sql
Create the horde database in MySQL:REPLACE INTO user (host, user, password)
VALUES (
'localhost',
'horde',
-- IMPORTANT: Change this password!
PASSWORD('your_secret_password')
Code: Select all
mysql -u root -p < mysql_create.sql
Code: Select all
nano $DOCROOT/config/horde.php
Uncomment lines 171 to 176 and set the propper values.$conf['prefs']['driver'] = 'sql';
- Installing and configuring Turba -$conf['prefs']['params']['phptype'] = 'mysql';
$conf['prefs']['params']['hostspec'] = 'localhost';
$conf['prefs']['params']['username'] = 'horde';
$conf['prefs']['params']['password'] = 'your_secret_password';
$conf['prefs']['params']['database'] = 'horde';
$conf['prefs']['params']['table'] = 'horde_prefs';
Emerge turba and rename the config files from foo.php.dist to foo.php:
Code: Select all
emerge -a horde-turba
cd $DOCROOT/turba/config
for f in *.dist ; do mv ${f} ${f/.dist} ; done
Code: Select all
nano $DOCROOT/turba/scripts/drivers/turba.sql
Create the turba table in the database:-- $Horde: turba/scripts/drivers/turba.sql,v 1.4.2.4 2002/09/11 11:32:35 jan Exp $
CONNECT horde;
Code: Select all
cd $DOCROOT/turba/scripts/drivers
mysql -u root -p < turba.sql
Code: Select all
nano $DOCROOT/turba/config/sources.php
Then change the password in line 146.
Now edit the config that specify which other modules you want to be shown in the turba menu:$cfgSources['localsql'] = array(
'title' => 'My Addressbook',
'type' => 'sql',
'params' => array(
'phptype' => 'mysql',
'hostspec' => 'localhost',
'username' => 'horde',
'password' => 'your_secret_password',
'database' => 'horde',
'table' => 'turba_objects'
),
Code: Select all
nano $DOCROOT/turba/config/conf.php
Activate turba in the horde registry.php:$conf['menu']['apps'] = array('imp','kronolith','mnemo');
Code: Select all
nano $DOCROOT/config/registry.php
$this->applications['turba'] = array(
'fileroot' => dirname(__FILE__) . '/../turba',
'webroot' => $this->applications['horde']['webroot'] . '/turba',
'icon' => $this->applications['horde']['webroot'] . '/turba/graphics/turba.gif',
'name' => _("Address Book"),
'allow_guests' => false,
'status' => 'active'
- Installing and configuring Kronolith -
Emerge kronolith and rename the config files from foo.php.dist to foo.php:
Code: Select all
emerge -a horde-kronolith
cd $DOCROOT/kronolith/config
for f in *.dist ; do mv ${f} ${f/.dist} ; done
Code: Select all
nano $DOCROOT/kronolith/scripts/drivers/kronolith.sql
Create the kronolith table in the database:-- $Horde: kronolith/scripts/drivers/kronolith.sql,v 1.3.2.2 2002/09/25 22:32:48 jan Exp $
CONNECT horde;
Code: Select all
cd $DOCROOT/kronolith/scripts/drivers
mysql -u root -p < kronolith.sql
Code: Select all
nano $DOCROOT/kronolith/config/conf.php
Edit the menu settings on line 66 to show whichever modules you want to be seen there, e.g.:// What calendar backend is being used? Right now, the only options are
// 'mcal' and 'sql', but others may appear at some point in the future.
$conf['calendar']['driver'] = 'sql';
// What MCAL driver is being used? 'mstore' is the local file driver,
// and is the only one with extensive testing. There is also an ICAP
// driver, and theoretically an ICAP server, but Kronolith has not
// been tested with them.
//$conf['calendar']['params']['driver'] = 'mstore';
// The mstore driver requires a username and a password that is in
// /etc/mpasswd in order to access local calendars.
// $conf['calendar']['params']['username'] = '';
// $conf['calendar']['params']['password'] = '';
// This is an example configuration for an sql driver, in this case MySQL.
$conf['calendar']['params']['phptype'] = 'mysql';
$conf['calendar']['params']['hostspec'] = 'localhost';
$conf['calendar']['params']['username'] = 'horde';
$conf['calendar']['params']['password'] = 'your_secret_password';
$conf['calendar']['params']['database'] = 'horde';
$conf['calendar']['params']['table'] = 'kronolith_events';
Activate kronolith in the horde registry.php:$conf['menu']['apps'] = array('imp','turba','mnemo');
Code: Select all
nano $DOCROOT/config/registry.php
- Installing and configuring Mnemo -$this->applications['kronolith'] = array(
'fileroot' => dirname(__FILE__) . '/../kronolith',
'webroot' => $this->applications['horde']['webroot'] . '/kronolith',
'icon' => $this->applications['horde']['webroot'] . '/kronolith/graphics/kronolith.gif',
'name' => _("Calendar"),
'allow_guests' => false,
'status' => 'active'
Emerge mnemo and rename the config files from foo.php.dist to foo.php:
Code: Select all
emerge -a horde-mnemo
cd $DOCROOT/mnemo/config
for f in *.dist ; do mv ${f} ${f/.dist} ; done
Code: Select all
nano $DOCROOT/mnemo/scripts/drivers/mnemo_memos.sql
Run the table creation script:-- $Horde: mnemo/scripts/drivers/mnemo_memos.sql,v 1.1.2.1 2002/12/28 20:48:00 jan Exp $
CONNECT horde;
Code: Select all
cd $DOCROOT/mnemo/scripts/db
mysql -u root -p < mnemo_memos.sql
Code: Select all
nano $DOCROOT/mnemo/config/conf.php
Edit the menu options, on line 65, for whichever modules you want displayed:// What storage driver should we use? Valid values are 'sql'.
$conf['storage']['driver'] = 'sql';
// Any parameters that the storage driver needs. This includes
// database or ldap server, username/password to connect with, etc.
// Below is an example configuration for an sql driver, in this case
// MySQL.
$conf['storage']['params'] = array();
$conf['storage']['params']['phptype'] = 'mysql';
$conf['storage']['params']['hostspec'] = 'localhost';
$conf['storage']['params']['username'] = 'horde';
$conf['storage']['params']['password'] = 'your_secret_password';
$conf['storage']['params']['database'] = 'horde';
$conf['storage']['params']['table'] = 'mnemo_memos';
Then finally activate mnemo in the horde registry.php:$conf['menu']['apps'] = array('imp','turba','kronolith');
Code: Select all
nano $DOCROOT/config/registry.php
- Installing and configuring Passwd -$this->applications['mnemo'] = array(
'fileroot' => dirname(__FILE__) . '/../mnemo',
'webroot' => $this->applications['horde']['webroot'] . '/mnemo',
'icon' => $this->applications['horde']['webroot'] . '/mnemo/graphics/mnemo.gif',
'name' => _("Memos"),
'allow_guests' => false,
'status' => 'active'
Emerge Passwd and rename the config files from foo.php.dist to foo.php:
Code: Select all
emerge -a horde-passwd
cd $DOCROOT/passwd/config
for f in *.dist ; do mv ${f} ${f/.dist} ; done
Code: Select all
nano $DOCROOT/passwd/config/backends.php
You can set different options for encrypting and password policies here. mine looks like this:
PLEASE NOTE!$backends['vpopmail'] = array (
'name' => 'vpopmail Authentication',
'preferred' => '',
'password policy' => array(
'minLength' => 3,
'maxLength' => 8,
'maxSpace' => 0,
'minUpper' => 0,
'minLower' => 0,
'minNumeric' => 0
),
'driver' => 'vpopmail',
'params' => array(
'phptype' => 'mysql',
'hostspec' => 'localhost',
'protocol' => 'tcp',
// 'port' => 3306,
// 'socket' => '/tmp/mysql.sock',
'username' => 'vpopmail',
'password' => 'your_vpopmail_password',
'encryption' => 'crypt-md5',
'database' => 'vpopmail',
'table' => 'vpopmail',
'name' => 'pw_name',
'domain' => 'pw_domain',
'passwd' => 'pw_passwd',
// 'clear_passwd' => 'pw_clear_passwd',
'use_clear_passwd' => false
)
);
You need to use the vpopmail database name, the vpopmail username and the vpopmail password here.
If you have problems getting Passwd to work, take a look here.
Activate passwd in the horde registry.php:
Code: Select all
nano $DOCROOT/config/registry.php
Also note:$this->applications['passwd'] = array(
'fileroot' => dirname(__FILE__) . '/../passwd',
'webroot' => $this->applications['horde']['webroot'] . '/passwd',
'icon' => $this->applications['horde']['webroot'] . '/passwd/graphics/lock.gif',
'name' => _("Password"),
'allow_guests' => false,
'show' => true,
'status' => 'active'
If a user wants to change his/her password with Passwd in Horde, he/she must use the entire username@domain.org in the username box, just like when login in to Horde.
The Passwd step isn't covered in the guide from which I copied most of this HOWTO, so it's taken from memory, but I think this was all that was to it.
Final notes:
This is my first HOWTO, so I hope it's not too hard to follow. I've tried to make it as clear and to the point as I could.
I'm not a native English speaker, so I'm sure there are some spelling and gramatical errors. I'll correct them when I become aware of them.
If you find any errors or have additional information, please post it here and I'll edit the guide.




