When configuring a webmail solution for Debian 5.0 Lenny, we need to consider both functionality and security. While SquirrelMail remains a popular choice (currently at version 1.4.22 in Debian repositories), newer alternatives offer improved security and modern interfaces.

Here are three robust options with Debian package availability:

# Installation commands for each option:
1. SquirrelMail:
sudo apt-get install squirrelmail
sudo squirrelmail-configure

2. Roundcube (recommended):
sudo apt-get install roundcube roundcube-mysql roundcube-plugins

3. RainLoop (lightweight alternative):
wget https://www.rainloop.net/repository/webmail/rainloop-community-latest.zip
unzip rainloop-community-latest.zip -d /var/www/webmail

Your approach using IMAPS (port 993) is correct. Here's how to configure Roundcube for secure connections:

// Sample Roundcube config.inc.php excerpt
$config['default_host'] = 'ssl://mail.yourdomain.com';
$config['default_port'] = 993;
$config['imap_conn_options'] = array(
    'ssl' => array(
        'verify_peer' => true,
        'verify_depth' => 3,
        'cafile' => '/etc/ssl/certs/ca-certificates.crt',
    ),
);

For your Xen-based deployment, consider these security practices:

• Place the webmail VM in a DMZ separate from your mail server
• Configure iptables rules to restrict webmail VM access only to IMAPS port on mail server
• Implement regular integrity checks for webmail files

To monitor for password collection attempts, configure OSSEC with these rules:

# Sample OSSEC rule for webmail modifications
<rule id="100101" level="10">
    <category>webapp</category>
    <match>POST /webmail/login.php</match>
    <description>Webmail login form submission modified</description>
</rule>

For a small server, enable these PHP opcode cache settings in /etc/php5/apache2/php.ini:

opcache.enable=1
opcache.memory_consumption=128
opcache.interned_strings_buffer=8
opcache.max_accelerated_files=4000
opcache.revalidate_freq=60

For a Debian 5.0 Lenny server, you have several solid open-source webmail choices:

• SquirrelMail: The classic choice with simple PHP architecture
• Roundcube: Modern AJAX interface with better features
• RainLoop: Lightweight and fast with good security

Your IMAP-over-SSH approach (port 993) is sound. Here's why:

# Example stunnel configuration for IMAPS
[imaps]
accept = 993
connect = localhost:143
cert = /etc/ssl/certs/webmail.crt
key = /etc/ssl/private/webmail.key

For intrusion detection, consider fail2ban:

# /etc/fail2ban/jail.local
[webmail-auth]
enabled = true
port = https,http,993
filter = webmail-auth
logpath = /var/log/webmail/auth.log
maxretry = 3
bantime = 3600

For Debian Lenny:

# Add backports for newer PHP
echo "deb http://archive.debian.org/debian/ lenny-backports main" >> /etc/apt/sources.list
apt-get update
apt-get install -t lenny-backports roundcube roundcube-mysql

Nginx configuration snippet:

server {
    listen 443 ssl;
    server_name webmail.example.com;
    
    ssl_certificate /etc/ssl/certs/webmail.crt;
    ssl_certificate_key /etc/ssl/private/webmail.key;
    
    location / {
        root /var/lib/roundcube;
        index index.php;
    }
    
    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php5-fpm.sock;
        include fastcgi_params;
    }
}

For a simpler solution:

apt-get install squirrelmail
ln -s /usr/share/squirrelmail/ /var/www/webmail

Configuration file adjustment:

// config/config_local.php
$imap_server_type = 'dovecot';
$imap_port = 993;
$use_imap_tls = true;