RoundCube webmail not able to change user password

aaP_joel2

Hi all,

I've done a bit of searching and cannot find confirmation that an end-user should be able to change their password in RoundCube email.
Whenever it is attempted, it throws an Error No. [600] and won't change. Screenshot attached.

I've tried both methods of fixing it - disabling XSS protection and also ensuring that /www/vmail/ is in the user.ini file.

Neither make any difference.

I've also tried installing the Roundcube instance through Mail Domains (new way) or through the one-click deployment tool.

Neither make any difference.

Struggling to find a way my users can change their own passwords without having an administrator change it for them.

aaPanel_Kern

Hello,
Thanks for your feedback, we are trying to figure out how to fix this

indyarockr

Any fix yet please?

aaPanel_Kern

Hello,
Sorry, there is currently no solution due to permission issues

aaP_minerslol44

It sounds like the password change feature isn’t linking correctly with the mail setup. Maybe check if the RoundCube password plugin matches your mail backend. A small config or permission issue can sometimes block it.

indyarockr

I am able to fix it and now password change is working on my aapanel 🙂

Here is what I did:

Let PHP touch the mailbox DB (open_basedir fix).

Added .user.ini in the site root with:
open_basedir=/www/wwwroot/my_domain_email/:/tmp/:/proc/:/www/vmail/
Restarted PHP-FPM so Roundcube (PHP-FPM) could access /www/vmail/postfixadmin.db.

Made the DB writable by web + readable by Dovecot.
Put the web user in the mail group, then:

chown -R www:mail /www/vmail
chmod 2770 /www/vmail (setgid so new files inherit group)
chmod 660 /www/vmail/postfixadmin.db

Pointed Dovecot to the same SQLite that Roundcube updates.
/etc/dovecot/dovecot-sql.conf.ext → driver = sqlite, connect = /www/vmail/postfixadmin.db
Corrected password_query + user_query for mailbox table.
Aimed Roundcube at a guaranteed IMAP endpoint.
default_host = 'ssl://127.0.0.1', default_port = 993, with relaxed verify options (to bypass the current CN mismatch).
This fixed “Login failed” (IMAP auth mismatch).
Avoided blocked exec() by hashing in PHP.
Password plugin: hash-bcrypt + password_algorithm_prefix = '{BLF-CRYPT}'.
Stored {BLF-CRYPT}$2y$… which Dovecot accepts—no doveadm pw call needed.
Restarted services so changes actually applied.
Reloaded PHP-FPM (to pick up .user.ini and config changes) and restarted Dovecot.
Validated everything end-to-end.
ss -lntp showed IMAP/IMAPS listening.
doveadm auth test user@domain pass succeeded.

Now, roundcube login worked, and the password plugin could write the new hash to SQLite.

indyarockr

@aaPanel_Kern I did some changes to php and now I am unable to send or receive mail. Please, help sir.

aaPanel_Kern

What error message does the email fail to send? What information does the log contain?

indyarockr

I want to completely remove it and re-install it. Getting:

Get the mail server conf error!

aaPanel_Kern

Please check whether postfix, etc. are successfully installed.

indyarockr

aaPanel_Kern
Neither installed, nor able to install it. What to do, please? I once tried to install iredmail.

aaPanel_Kern

It is recommended that you check the installation process for error messages, Log file: /tmp/panelExec.log

indyarockr