Introduction
This guide explains how to install SquirrelMail on CentOS, covering the EPEL repository setup, installation, configuration, and Apache integration needed to get a working webmail interface up and running.
SquirrelMail is a standards-based webmail package written in PHP, with built-in support for the IMAP and SMTP protocols implemented in pure PHP rather than relying on external libraries. It was widely used in the 2000s and early 2010s as a lightweight, no-JavaScript-required webmail client for shared hosting and small mail servers.
Before you proceed, there’s something worth knowing upfront: SquirrelMail’s last stable release was in 2011, and the project has been effectively unmaintained since then. This guide documents the installation process accurately, including the steps and caveats that matter for real-world use — but Step II includes an important note on why this may not be the right choice for a new, security-conscious deployment in 2026, along with actively maintained alternatives to consider instead.
Implementation
I. Prerequisites
Before you install SquirrelMail on CentOS, make sure you have:
- A CentOS server (this guide covers CentOS 7 and CentOS 8/Stream conventions, noted separately where they differ)
- Root or sudo access
- Apache (
httpd) installed and running - A working mail transfer agent (Postfix, Sendmail, or similar) already configured, since SquirrelMail is a webmail client, not a mail server itself
- Basic familiarity with editing Apache configuration files
II. Important: SquirrelMail’s Maintenance Status
Before installing, it’s worth being direct about this: SquirrelMail has not had a stable release since 2011, and its last plugin/security update activity was years ago. Practically, this means:
- It does not officially support PHP 7 or PHP 8, which are what current CentOS versions and security-patched PHP repositories ship by default — you may need an older, unsupported PHP version to get it running at all, which carries its own security risk
- Known vulnerabilities in older SquirrelMail versions do not have official patches
- It’s very unlikely to receive updates addressing any new vulnerabilities discovered going forward
If you’re setting up a new webmail interface today, Roundcube is the actively maintained, modern equivalent — it supports current PHP versions, receives regular security updates, and offers a considerably better user interface. This guide still documents SquirrelMail’s installation process accurately for cases where you have a specific legacy requirement (maintaining an existing SquirrelMail deployment, matching a specific old environment, or educational purposes) — but for any new production deployment, strongly consider Roundcube instead.
III. Architecture Overview
Before installing anything, it helps to see how the pieces actually fit together. SquirrelMail itself doesn’t send or store any mail — it’s purely a web-based front end that talks to your existing mail server on the user’s behalf:
- A user’s browser sends an HTTPS request to Apache, just like loading any other web page
- Apache, running SquirrelMail’s PHP code, handles that request and renders the webmail interface
- To display incoming mail, SquirrelMail connects to your IMAP server and fetches messages from the user’s mailbox
- To send a new message, SquirrelMail connects to your SMTP server and hands off the outgoing mail for delivery
This is why Step V (the configuration script) asks for IMAP and SMTP server details — SquirrelMail is only a client, and everything it displays or sends ultimately depends on a correctly configured mail server sitting behind it.
IV. Add the EPEL Repository
SquirrelMail is available through the EPEL (Extra Packages for Enterprise Linux) repository. The correct command depends on your CentOS version — older tutorials (including very old EPEL RPM URLs) commonly reference outdated, no-longer-valid package paths, so use the version-appropriate command below rather than a hardcoded old RPM URL.
CentOS 7:
sudo yum install epel-release -y
CentOS 8 / CentOS Stream:
sudo dnf install epel-release -y
Note: Older guides sometimes reference a specific, hardcoded EPEL RPM file URL (often for EPEL 5, matching CentOS 5 — a version that reached end-of-life in 2017). Those direct RPM links are frequently dead or hopelessly outdated at this point. Installing
epel-releasethrough your package manager, as shown above, always pulls the correct, current EPEL package for your specific CentOS version instead.
V. Install SquirrelMail
With EPEL enabled, install the package:
CentOS 7:
sudo yum install squirrelmail -y
CentOS 8 / CentOS Stream:
sudo dnf install squirrelmail -y
If the package isn’t found, double-check that the EPEL repository installed successfully in the previous step, and that it’s enabled — run
sudo yum repolist(ordnf repolist) and confirmepelappears in the list.
VI. Run the SquirrelMail Configuration Script
Navigate to SquirrelMail’s configuration directory:
cd /usr/share/squirrelmail/config/
Run the interactive configuration script:
sudo ./conf.pl
This opens a text-based menu. The two sections you’ll need to configure are:
Organization details (menu option 1): Set your organization’s name, logo, and title — these are cosmetic settings shown to users on the login and webmail pages.
Server settings (menu option 2): Configure your domain name, the mail transfer agent type, and the IMAP/SMTP server addresses SquirrelMail should connect to. These values need to match your actual mail server setup (Postfix, Sendmail, Dovecot, etc.) — get this wrong and SquirrelMail will install fine but fail to actually send or receive mail.
Once both sections are configured, save and exit:
- Type
Sto save - Type
Qto quit
VII. Create an Apache Configuration for SquirrelMail
SquirrelMail needs to be exposed through Apache as a web-accessible path. Rather than appending configuration directly to the end of your main Apache config (which can be easy to lose track of or accidentally break during future edits), create a dedicated config file:
sudo vi /etc/httpd/conf.d/squirrelmail.conf
Add the following:
Alias /webmail /usr/share/squirrelmail
<Directory /usr/share/squirrelmail>
Options Indexes FollowSymLinks
AllowOverride All
DirectoryIndex index.php
Require all granted
</Directory>
Note:
Require all grantedis the modern Apache 2.4 syntax. Older tutorials often showOrder allow,deny/Allow from all, which is Apache 2.2 syntax — using the old syntax on a 2.4+ server (which is what current CentOS versions ship) can cause the directory to be inaccessible or throw a configuration error, since Apache 2.4 changed its access-control directive syntax entirely.
VIII. Restart Apache
Apply the new configuration:
CentOS 7:
sudo systemctl restart httpd
CentOS 8 / CentOS Stream:
sudo systemctl restart httpd
(The command is the same across both versions — systemctl is standard on both.)
IX. Verify Apache Loaded the Configuration Correctly
Before testing in a browser, check for syntax errors in your Apache configuration:
sudo apachectl configtest
You should see Syntax OK. If there’s an error, it will point you to the specific file and line that needs correcting.
X. Access SquirrelMail in a Browser
Open a browser and navigate to:
http://your-server-ip/webmail
or, if you have a domain pointed at the server:
http://your-domain.com/webmail
You should see the SquirrelMail login page. Log in using a valid email account’s username and password (as configured on your mail server) to confirm the connection to your IMAP/SMTP backend is working correctly.
XI. Verify Mail Functionality
Once logged in, confirm the full mail pipeline works, not just the login:
- Send a test email to an external address (like a personal Gmail account) and confirm it arrives
- Send a test email from an external account to the mailbox you logged in with, and confirm it appears in the SquirrelMail inbox
If login works but sending or receiving fails, the issue is almost always in the mail server (Postfix/Sendmail/Dovecot) configuration referenced during Step V, not SquirrelMail itself.
XII. Securing Your SquirrelMail Installation
If you’re proceeding with SquirrelMail despite the maintenance caveats in Step II, a few steps meaningfully reduce risk:
- Serve it over HTTPS only. Since SquirrelMail submits login credentials via a standard web form, running it over plain HTTP means credentials are sent unencrypted — trivially interceptable on any shared or untrusted network. Configure an SSL/TLS certificate (Let’s Encrypt is free and straightforward) and redirect all HTTP traffic to HTTPS.
- Restrict access by IP where possible. If only a small, known set of users need access, restricting the
/webmailpath to specific IP ranges in your Apache config significantly reduces exposure to automated attacks. - Keep the underlying PHP version as current as SquirrelMail’s compatibility allows, and monitor for any compatibility patches from the community, since the official project itself is inactive.
- Consider it a stepping stone, not a destination. If this is a legacy system, treat this installation as something to migrate off of during your next maintenance window, not a long-term fixture.
XIII. Troubleshooting Common Issues
“Package squirrelmail not found” during installation: Confirm EPEL installed correctly (yum repolist / dnf repolist should show epel), and that you’re running the install command with sudo or as root.
SquirrelMail loads but shows a blank page or PHP errors: This is commonly a PHP version incompatibility, given SquirrelMail’s age. Check your installed PHP version with php -v and compare against SquirrelMail’s documented supported versions — you may need an older PHP package from a compatibility repository, which reinforces the caveat in Step II about weighing this against a modern alternative.
Login page loads but authentication always fails: Revisit the server settings from Step V — specifically the IMAP server address and port. A mismatch here is the most common cause of “correct password, but login fails” symptoms.
Apache throws a configuration error after adding the SquirrelMail block: Run apachectl configtest as shown in Step VIII — it will point to the specific line causing the issue, which is often the old Apache 2.2 access-control syntax mentioned in Step VI’s note.
XIV. Conclusion
You’ve now installed SquirrelMail on CentOS, added it as an accessible path through Apache, and verified that both login and actual mail delivery work end-to-end. The process itself is straightforward — EPEL, package install, a short configuration script, and an Apache alias — but the more important decision is a strategic one: SquirrelMail’s lack of active maintenance since 2011 means it’s a reasonable choice only for specific legacy or educational scenarios, not for a new production mail interface in 2026. For anything new, Roundcube offers the same core functionality with active development and current PHP support behind it.
For further reference on EPEL and CentOS package management, see the official EPEL documentation.
Frequently Asked Questions
Is SquirrelMail still safe to use in production? Given its lack of updates since 2011, it carries meaningfully more risk than an actively maintained alternative. If you choose to use it anyway — for a legacy system or specific compatibility requirement — pair it with the hardening steps in Step XI, particularly HTTPS and IP restriction.
What’s a good modern alternative to SquirrelMail? Roundcube is the most commonly recommended modern equivalent — open-source, actively maintained, PHP 8 compatible, and with a considerably more modern interface while still being lightweight compared to larger webmail suites.
Why does my old EPEL RPM URL return a 404 or fail to install? Very old tutorials often reference a specific, version-pinned EPEL RPM URL (frequently for EPEL 5, matching CentOS 5, which reached end-of-life in 2017). These specific URLs are frequently removed or relocated over time. Installing epel-release through yum or dnf directly, as shown in Step III, always resolves to the correct current package for your CentOS version instead of relying on a URL that can go stale.
Can I run SquirrelMail alongside a different, more modern webmail client? Yes — since SquirrelMail is exposed at a specific Apache alias path (/webmail in this guide), you can install a second webmail client at a different path (like /mail for Roundcube) and run both simultaneously, which is a reasonable way to migrate users gradually rather than cutting over all at once.
Talk to Our Technology Experts
Setting up mail services or looking to modernize an aging webmail deployment? Our team can help with server administration, mail server configuration, security hardening, and ongoing infrastructure support.
Connect with our technology experts.
Related Articles