how to increase security of squirrelmail?

Hi Locklear, Thanks for the reply. Just a few of clarification questions so I can start finding my way:

- Check that PHP variable register_globals is turned OFF
How do I do this? (Where and which file?)

- Use database backend for user data
Ok. I already do.

- If your mail server is on different server
No, it's on the same server as apache & squirrelmail

- Use SSL/TSL connection to your Squirrel Mail web
I remembered installing SSL when installing postfix. Should I install a separate one for Squirrelmail? I don't think we want to buy a certificate from an authority. If I make one for myself, (as I did during postfix installation), is that going to be  a problem? How will that secure the system when users are using internet cafe? WIll that prevent their passwords from being stolen/saved in the computer?
(I'm thinking, in comparison, of hotmail/gmail where we have an option to "increase security"

- Instruct your users that they should select striong passwords
Impossible. My users are worst than lemmings.

- I've seen some hints on google to force https using redirect. I'm not sure that I understand 100% and I'm not comfortable enough with the information that I have to start making the changes. Do you know about this?

- On the certification solution:
Am I right to think that this is more to prevent clients from entering a fake login page?
I was actually not to concerned with this as I don't think anyone will bother doing that to us.
I'm more concerned about user passwords getting stolen/intercepted when they're using public computers. So one of the aim is to prevent browsers from remembering user passwords.


- On the https solution:
Yes. Forcing https connection. This is what I'm getting :

http://fedoraforum.org/forum/showthread.php?t=93267
See second post by amnesia. (similiar to your solution)

http://squirrelmail.org/plugin_view.php?id=61
Seems to be a different solution to the fedora guide above. (I'm using ubuntu by the way).

If a public computer is compromised by a virus/trojan or has a keylogger installed, there is absolutely nothing you can do to prevent and protect your user using that system unless you add a second mode of authentication i.e. RSA type key and possibly a smart card auth.

Thinking one is not on a radar of hackers/spammer/etc, is a mistake.  There are way too many motivations one might have.  Without compromising your server, the access gained with an existing user's credentials are enough to send out a massive amount of spam potentially using bots to send email messages through your system/s.

.... so what can I do?

I can understand that with keyloggers, there's really not much I can do. But otherwise, I suppose all I can do is setup https in squirrelmail and then setup redirect to https in postfix?

Also, is the threat limited to user accounts and not the server itself? (or worse: ability to penetrate to other computers in my network? same firewall zone or different zones?)

To answer your question:
"Do you have your postfix setup so your users can remotely send through it. SMTP AUTH, pop before SMTP, etc.?" : Yes I do. This is what (I think) the system use for webmail.

"Possibly limiting outgoing emails sent from a single user i.e. 100 in 1 minute."
Actually, I've been trying unsuccesfully to do the exact opposite. You see, the server is actually a relay server where it relays outgoing mails via ISP. (It also fetches emails, but its irrelevant for this paragraph.)
The ISP limits outgoing emails to 100/hour. ANything beyond 100 is bounced by my own ISP. SO I've been trying to get my relay server to queue the excess emails and pass it on to ISP mailserver after 1 hour. The problem is I can only set the rate and have it bounced back, not queued.