For administrators
Administration
Setting Webmail up and running it for an organisation.
1. Connect the mail server
Go to Settings → Webmail Settings and run the setup wizard. You need your provider's IMAP and SMTP hostnames, your mail domain, and one working mailbox to test with.
Ports and the security mode are set in the wizard, and every choice is encrypted. Defaults are IMAP 993 and SMTP 465 with SSL/TLS; choose STARTTLS for servers that upgrade a plain connection (typically ports 143 and 587). With STARTTLS the upgrade is mandatory — a server that does not complete it is refused before your password is sent — and there is no “ignore certificate errors” switch in either mode: not disabled, absent. Mailbox passwords travel over these connections, so an unencrypted or unverified one is not a supported configuration.
The wizard checks four things in order and stops at the first failure, so you get one actionable problem rather than four red rows:
- Address — the hostnames resolve and are permitted.
- Encryption — TLS works and the certificate matches the hostname.
- Incoming — IMAP sign-in succeeds and folders are found.
- Outgoing — SMTP sign-in succeeds. No mail is sent.
2. Decide who supplies passwords
| Mode | What happens | Suits |
|---|---|---|
| Users connect their own | Each employee enters their own mailbox password once. | Most organisations. Nobody has to handle anyone else's password. |
| Administrators provision | You enter each mailbox password in the credential centre. | Shared or role mailboxes, or where staff do not know their own password. |
3. The credential centre
Settings → Mailbox Credentials lists every mailbox with its state. From here you can add or remove a mailbox, replace a password, test one, and clear a lockout.
The owner of a mailbox cannot be changed by editing it. To move a mailbox to a different person, delete it and create a new one. Editing the owner would carry the stored password across with it — which would mean gaining access to someone else's mail without knowing their password.
4. Bulk import (optional)
A CSV with email, password and optionally
username columns provisions many mailboxes at once. Employees are matched by
their ERPat email address. Each row is tested against the mail server before anything is
stored, and the progress console names any row that fails and why.
That file is a list of plaintext passwords. ERPat deletes its own copy as soon as it has read it, and sweeps anything left behind within two hours. Delete your copy too — and prefer having staff enter their own passwords where you can.
5. Permissions
| Permission | Grants |
|---|---|
| Webmail (own mailbox) | Read one's own mail. |
| Compose & Send Mail | Reply and send. |
| Manage Mail Accounts | The credential centre: provision, revoke, unlock, import. |
| Webmail Connection Settings | The server setup wizard. |
None of these grants access to anyone else's mail. Managing credentials and reading mail are separate surfaces, and the administrative one has no message screens at all.
6. Scheduled jobs
| Job | Runs | Does |
|---|---|---|
| Webmail: file sent messages in Sent | Every 5 minutes | Files a copy of an already-delivered message into Sent when the first attempt failed. It never re-sends mail. |
| Webmail: housekeeping | Hourly | Discards stored copies of sent messages once filed, removes credential-import leftovers and attachments uploaded for messages that were never sent, and clears expired lockouts. |
Turning Webmail off
Settings → Manage Modules. Disabling it hides Webmail everywhere and blocks its pages. Stored credentials remain encrypted in place and work again if you re-enable it; to remove them, delete the mailboxes in the credential centre first.