Additional installation and update information: Upstream documentation: http://trac.roundcube.net/wiki Notice - temporary files are stored in /var/lib/roundcubemail/temp - logs files are stored in /var/log/roundcubemail - configuration files are stored in /etc/roundcubemail - PGP keys used by enigma plugin are stored in /var/lib/roundcubemail/enigma As those directories are not served by the web server, there is no need to protect them. Databases Roundcube supports various database providers, including SQLite, MySQL and PostgreSQL. The package depends only on php-pdo, which provides SQLite support. However, the default configuration is for a MySQL database, for performance reasons. To use the MySQL database, ensure php-mysql is installed. If you want to use another database, adjust the configuration file, and ensure the appropriate PDO plugin is installed. If necessary. The installer is available at http://localhost/roundcubemail/installer The webmail is available at http://localhost/roundcubemail By default, access to Roundcube and the installer is only allowed from the server, locally, in /etc/httpd/conf.d/roundcubemail.conf . Best practice is to create a new file - e.g. /etc/httpd/conf.d/z-roundcubemail-allow.conf - to adjust the access permissions. You can also edit roundcubemail.conf directly, but then any changes to it in future package updates will cause the creation of a .rpmnew file, and you will have to merge the changes manually: creating a new config file to configure access permissions avoids that. First use the installer to configure Roundcube, ideally from the server so you do not need to allow any wider access to the installer, but you can use a new config file to grant wider access to /usr/share/roundcubemail and /usr/share/roundcubemail/installer if necessary. Once you have completed deployment, you should restrict access to the /installer subdirectory again, as an attacker could use it to do anything they liked to your Roundcube installation. UPGRADING: when upgrading from < 1.0 the old configuration files named main.inc.php and db.inc.php are now deprecated and should be replaced with one single config.inc.php file. Run the /usr/share/roundcube/bin/update.sh script as root to get this conversion done or manually merge the files. The update script will also update the database configuration. Check the permissions of the config.inc.php file and all backups the script creates! Make sure they are not world-readable, as they may contain sensitive information (e.g. database passwords). NOTE: the new config.inc.php should only contain options that differ from the ones listed in defaults.inc.php.