The Craving Mind

Step:- 01 # sudo apt-get update && sudo apt-get upgrade # sudo apt-get install libsasl2-modules postfix #vi /etc/posttfix/main.cf myhostname = mail.drbdtest.com Step:-02 Generate app password for postfix Step:-03 Add Gmail username and password to postfix vi /etc/postfix/sasl/sasl_passwd [smtp.gmail.com]:587 username@gmail.com:password #sudo postmap /etc/postfix/sasl/sasl_passwd sudo chown root:root /etc/postfix/sasl/sasl_passwd /etc/postfix/sasl/sasl_passwd.db sudo chmod 0600 /etc/postfix/sasl/sasl_passwd /etc/postfix/sasl/sasl_passwd.db Configure postfix relay server #vi /etc/opstfix/main.cf relayhost = [smtp.gmail.com]:587 # Enable SASL authentication smtp_sasl_auth_enable = yes # Disallow methods that allow anonymous authentication smtp_sasl_security_options = noanonymous # Location of sasl_passwd smtp_sasl_password_maps = hash:/etc/postfix/sasl/sasl_passwd # Enable STARTTLS encryption smtp_tls_security_level = encrypt # Location of CA certificates smtp_tls_CAfile = /etc/ss...

General Configuration and Administration Postfix default directories: /etc/postfix                        [Configuration files and lookup tables] /usr/libexec/postfix         [ Postfix daemons] /var/spool/postfix           [ Queue files] /usr/sbin                              [ Postfix commands] Starting Postfix the First Time 1. Set hostname properly Postfix uses a configuration parameter called myhostname, which must be set to the fully qualified hostname of the system Postfix is running on. Once Postfix knows the fully qualified hostname, it can use that hostname to set default values for other important parameters, such as mydomain. If the parameter myhostname is not set, Postfix defaults to the hostname reported by the system itself. $hostname #postconf -e myhostname=mail.drb...

Step:01 Blocking Memcached Exploit ################################## For Zimbra Single Server Installation Configure memcached to listen on 127.0.0.1 only to avoid this attack.  Use below commands. su - zimbra /opt/zimbra/bin/zmprov ms `zmhostname` zimbraMemcachedBindAddress 127.0.0.1  /opt/zimbra/bin/zmprov ms `zmhostname` zimbraMemcachedClientServerList 127.0.0.1 Restart memcached: zmmemcachedctl restart Ref: https://wiki.zimbra.com/index.php?title=Blocking_Memcached_Attack

First of all we want to change the existing smtpd restrictions and add a whole host of new checks to help reduce the amount of mail the system accepts in /etc/postfix/main.cf ### Checks to remove badly formed email smtpd_helo_required     = yes strict_rfc821_envelopes = yes disable_vrfy_command = yes unknown_address_reject_code  = 554 unknown_hostname_reject_code = 554 unknown_client_reject_code   = 554 smtpd_helo_restrictions = permit_mynetworks, reject_invalid_hostname, regexp:/etc/postfix/helo.regexp, permit ### When changing sender_checks, this file must be regenerated using postmap <file>, to generate a Berkeley DB smtpd_recipient_restrictions =    check_client_access hash:/etc/postfix/helo_client_exceptions    check_sender_access    hash:/etc/postfix/sender_checks,    reject_invalid_hostname, ### Can cause issues with Auth SMTP, so be weary!    reject_non_fqdn_hostname, #############...

A quick Fix till the root CA is installed Disable the TLS on the LDAP server as a workaround till the certificates are re-deployed Execute the below commands on the LDAP servers zmlocalconfig -e ldap_starttls_required=false zmlocalconfig -e ldap_starttls_supported=0 zmcontrol restart Once the certificates are re-deployed then enable TLS on the LDAP server again. zmlocalconfig -e ldap_starttls_required=true zmlocalconfig -e ldap_starttls_supported=1 zmcontrol restart Ref: https://wiki.zimbra.com/wiki/Root_CA_certificate_has_expired

Problem If the X-Originating-IP header is enabled, zimbra marks injected/local messages as spam. X-Spam-Flag: YES X-Spam-Score: 7.715 X-Spam-Level: ******* X-Spam-Status: Yes, score=7.715 tagged_above=-10 required=6.6 tests=[BAYES_00=-1.9, RCVD_IN_PBL = 3.335 , RCVD_IN_RP_RNBL=1.31, RDNS_NONE=0.793, TVD_PH_BODY_ACCOUNTS_PRE=2.393, TVD_PH_REC=1.784] autolearn=no autolearn_force=no X-Originating-IP : [73.188.218.230] X-Mailer: Zimbra 8.6.0_GA_1153 (ZimbraWebClient - FF36 (Win)/8.6.0_GA_1153) Resolution To fix that, we can disable the X-Originating-IP header as follows: Administrative Console -> Config -> Global Setting -> MTA -> Messages -> uncheck Add X-Originating-IP to messages. Additional Content The Spamhaus PBL is a DNSBL database of end-user IP address ranges which should not be delivering unauthenticated SMTP email to any Internet mail server, except those provided for specifically by an ISP for that customer's use. RCVD_IN_PBL lists IP addresses ...

Resolution In this article we will see how to redirect an email from a specific email address to a designated user. For example you have emails coming from advertisement@domain.com that are flooding your users, and you want to catch all emails from this email address, and to redirect them to a user (sysadm@domain.com) that will act as a quarantine user. To accomplish our task, we will be using Postfix Header check, to catch and redirect the emails. 1 . Go to: cd /opt/zimbra/conf 2 . Create a file for headers: touch /opt/zimbra/conf/custom_header_checks 3 . In this file add this line: /^From:(.*)advertisement@domain.com/ REDIRECT sysadm@domain.com 4 . Check the current settings: zmprov gcf zimbraMtaHeaderChecks 5 . If there are no entries you can run the following command to add the new file to the config: zmprov mcf zimbraMtaHeaderChecks 'pcre:/opt/zimbra/conf/custom_header_checks' If there is already a setting, you can just add the new to the old as fol...

Resolution Prerequisites: 0 . Due to the steps below, it is recommended to do the rename off working hours. 1 . Make sure the DNS records (MX records too) are changed beforehand to reflect the new domain, and to match the IP of the server. 2 . Check the hosts file of the server, and in any other servers, where this server exists. 3 . Take a backup. Whether full backup, snapshot of VM, or rsync the /opt/zimbra directory, its strongly recommended to have a backup. rsync -e ssh -axvzKHS /opt/zimbra/ 10.0.0.1:/tmp that command will copy /opt/zimbra directory to a remote machine with IP 10.0.0.1, in the /tmp directory (using ssh). Or, you can copy it to a local mounted disk: rsync -axvzKHS /opt/zimbra /mnt/zimbra_backup 4 . Important for ZCS 8.6 . If in the domain that you want to rename, there is an account/s for calendar resources (meeting rooms, equipment), rename it , so that it belongs to a different domain. If you have just one domain, create a dummy domain, so th...

cat /var/log/zimbra.log | sed -n 's/.*sasl_username=//p' | sort | uniq -c | sort -n 1 Auser@domain.com 3 Buser@domain.com 4 Cuser@domain.com 5 Duser@domain.com 36 SPAMMER@domain.com Ref: https://wiki.zimbra.com/wiki/How_to_find_SMTP_Auth_user_names_to_find_out_bulk_spam_user

Purpose This article explains how to bypass or white-list certain IP ranges, either because they are known to be trusted and internal, or because they provide specific services that should not be checked for spam. Resolution By default, the bypass is not enabled, and we need to enable it as follows: zmprov mcf zimbraAmavisOriginatingBypassSA TRUE When its enabled, we need to restart the following services: zmantispamctl restart zmantivirusctl restart zmamavisdctl restart <attr id="311" name="zimbraMtaMyNetworks" type="astring" max="10240" cardinality="multi" optionalIn="globalConfig,server" flags="serverInherited" requiresRestart="mta"> <desc>value of postfix mynetworks</desc> </attr> 1. postconf mynetworks 2. zmprov gs `zmhostname` zimbraMtaMyNetworks zmprov ms `zmhostname` zimbraMtaMyNetworks '127.0.0.0/8 10.0.0.0/8 192.168.0.0/16' (note: zmconfigd w...

This is because the default polling interval for the galsync account is 1 day. This can be reduced to 12h: zmprov mds galsync@example.com <internal datasource name> zimbraDataSourcePollingInterval 12h Example zmprov mds galsync@example.com InternalGAL zimbraDataSourcePollingInterval 12h If there's a need for an immediate update, simply forcesync: zmgsautil forceSync -a galsync@domain.com -n InternalGAL Ref: https://wiki.zimbra.com/wiki/GAL_list_doesn%27t_update_when_a_new_account_is_added

Creating a Dynamic Distribution List This creates the DL. All new and existing accounts become part of this newly-created DL. In this case, it will add all users, GAL account names, and spam/ham account names, as they are also accounts on your environment. $ zmprov cddl all@domain.com memberURL 'ldap:///??sub?(objectClass=zimbraAccount)' zimbraIsACLGroup FALSE Using COS This DL can be refined by modifying the filter. Therefore, the recommended approach is to create a COS called users, assign all users to that COS, and then modify the command as follows: $ zmprov cddl allusers@domain.com memberURL 'ldap:///??sub?(&(objectClass=zimbraAccount)(zimbraCOSId=53b3ab9e-f414-4eb7-bd98-393b62de15d3))' zimbraIsACLGroup FALSE Where zimbraCOSId=53b3ab9e-f414-4eb7-bd98-393b62de15d3 is COS ID of the COS created to, which all users are assigned. If a user is assigned to any other COS, the user will not be a member of this DL. Examples Dynamic DL containing all Active...

From the installation log we see: Executing: /tmp/tmp.mSlzRMclVa/gpg.1.sh --keyserver keyserver.ubuntu.com --recv-keys 9BE6ED79 gpg: requesting key 9BE6ED79 from hkp server keyserver.ubuntu.com gpg: keyserver timed out gpg: keyserver receive failed: keyserver error 1. Open port 11371 11371 tcp,udp hkp OpenPGP HTTP Keyserver 2. Force it to use port 80: gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 9BE6ED79 Ref: https://wiki.zimbra.com/wiki/Error_%22Unable_to_retrive_Zimbra_GPG_key_for_package_validation%22

Issue If a user's password is compromised, the Server default setup allows the user to relay emails using a different email address than the one uses to authenticate with smtp. A message header from that user looks like this: zimbra1 postfix/smtpd[29431]: B28914D5978: client=xxxxx.server.com[w.x.y.z], sasl_method=LOGIN, sasl_username= Where the sender's user name and the from address are indicated in bold. This article explains how to ensure that the from address matches the sender's username.  How-to Zimbra Collaboration 8.8.x, 8.7.x, 8.6 Note: Optional, use an exception DB If you want an exceptions DB to allow people to send as alternate addresses cd /opt/zimbra/conf edit slm-exceptions-db Add the alternate ID addresses and the real userid, for example for the user joe who has joe@gmail.com joe@gmail.com joe Then run postmap slm-exceptions-db to generate the database postmap slm-exceptions-db Update zimbraMtaSmtpdRejectUnlistedRecipient & zimbraMtaSmtpdRejec...

Purpose CLI method for deleting messages off a specific user account. Resolution In order to delete the message, you need to identify the message "msgid". First, note which user you are trying to delete (replace user@domain.com with the user you are trying to target), then issue the following command to find the message "msgid" that you want to delete: zmmailbox -z -m user@domain.com s -t message -l 50 "in:inbox date:01/01/2015" The above command will search a specific folder, Inbox in this case. Displays only messages dated 01/01/2015. Lists up to 50 messages. You will see something like the following after issuing the above command: Id Type From Subject Date ---- ---- ---------------- ------------------------------------------ -------------- 1. 432 mess user Daily mail report for 2015-01-01 01/01/15 23:30 2. 431 mess user ZCS Backup R...

Step:01  Open power shell in windows 10 Step:02 Open the prompt Step:03 Copy & Paste below items into power shell $EmailFrom = “test@domain.com” $EmailTo = “shariful.islam@bol-online.com” $Subject = “Test Mail” $Body = “Dear All, This is a test mail from power shell of WIN10” $SMTPServer = “mail.domain.com” $SMTPClient = New-Object Net.Mail.SmtpClient($SmtpServer, 25) $SMTPClient.EnableSsl = $false $SMTPClient.Credentials = New-Object System.Net.NetworkCredential(“test”, “123456”); $SMTPClient.Send($EmailFrom, $EmailTo, $Subject, $Body); The execution will be error less if everything is alright. Step:04 Check destination email address to confirm the delivery

Problem Default limit for mynetworks in postifx is ~4000 characters. If you have large list of networks/IPs to allow in mynetworks, then using zimbraMtaMyNetworks does not helps. Further zimbraMTAMyNetworks has a character limit of 10240. Solution Solution is to use mynetworks_maps in postfix. Below steps are tested on ZCS 8.7.11. Step 1 su - zimbra zmprov ms `zmhostname` zimbraMtaMyNetworks "lmdb:/opt/zimbra/conf/network_table" Configure the list of IPs in /opt/zimbra/conf/network_table in below format. Make sure to include server's ethernet and localhost IPs. 127.0.0.1 OK <SERVERIP> OK 1.1.1.1 OK 2.2.2.2 OK Step 2 Create a hashmap with: postmap /opt/zimbra/conf/network_table Step 3 Change below line in /opt/zimbra/conf/amavisd.conf.in to help amavisd process mynetwork maps. @mynetworks = qw( %%zimbraMtaMyNetworks%% ); Change to: @mynetworks_maps = qw( read_array('/opt/zimbra/conf/network_table')); Step 4 Restart ZC...

Purpose Change the recipient of the "daily mail report". Resolution By default, zmdailyreport uses smtp_destination to send the daily report. You need to change the following localconfig value as per your requirement: zmlocalconfig smtp_destination zmlocalconfig -e smtp_destination=user@domain.com

Purpose Another server has to relay mails via Zimbra, without authentication. Resolution Add the server to zimbraMtaMyNetworks . For example, if the server IP is 18.18.48.12 : zmprov ms zimbra.example.com zimbraMtaMyNetworks '127.0.0.0/8 10.10.130.0/24 18.18.48.12/32' Ref: https://wiki.zimbra.com/wiki/Another_server_has_to_relay_mails_via_Zimbra,_without_authentication

DNS The reverse DNS resolution (rDNS) is a determination of the domain name that is associated to an IP. Some email companies like AOL, for example, will reject any email that doesn't have a valid rDNS. Where needs to be configured? To have a perfect match between the rDNS and the SMTP Banner of the server, need to have the next: In the public DNS of the ISP provider. Or if you have control of the public DNS of your IP range, then you can add the rDNS by yourself. In the Zimbra Server, need to edit the HELO to match between it and the rDNS record. How to configure it? To modify the Public DNS to match the IP and the rDNS, you need to contact with your ISP provider, or if you have acces to edit the DNS record of your IP, then change it by yourself. For example, if you have the IP 60.60.60.60 and needs to resolve to mail.example.com. To edit the SMTP Banner and match it with the external rDNS. Need to edit the next in Zimbra: Zimbra 8.0.X zmlocalconfig -e postfix_sm...

Step 1:  if you have not distribution list, you can create distribution list as bellow. $zmprov cdl dltest@huuphan.local Add a member to a distribution list. Tip: You can add multiple members to a list from the administration console: $zmprov adlm dltest@drbdtest.com sharif@drbdtest.com $zmprov adlm dltest@drbdtest.com saikat@drbdtest.com Step 2: To enable milter services, two way From administration console to enable milter services To use command line to enable milter services. $zmprov ms `zmhostname` zimbraMilterServerEnabled TRUE $zmmailboxdctl restart $zmmtactl restart $zmcontrol status $zmmilterctl start The only list member can sending mail to dltest@huuphan.local $zmprov grr dl dltest@drbdtest.com grp dltest@drbdtest.com sendToDistList To check permission member can sending dltest@huuphan.local $zmprov ckr dl dltest@drbdtest.com tabia@drbdtest.com sendToDistList The output DENIED   $zmprov ckr dl dltest@huuphan.local saikat@huuphan.local sendToDis...

Format: zmprov grr dl list@example .tld usr user@example .tld sendAsDistList PoC: sudo su - zimbra zmprov grr dl dlist @domain usr sharif @domain sendAsDistList Revoke: zmprov rvr dl dlist @domain usr sharif @domain sendAsDistList Ref: https://blog.dgprasetya.com/zimbra-send-as-distribution-list/ https://forums.zimbra.org/viewtopic.php?t=12703

1. To manage e-mails or domains so that they always reach the junk folder, we will go to the Zimbra Preferences tab in the Mail section. 2. Once here, we will move to the bottom of the screen, where we will see a space called Spam mail options : 3. Here, we can manage both, blocking an account or domain so that they arrive directly to the junk folder in Block messages from: , or on the contrary, allow the entry of e-mails that interest us which are marked by Zimbra as spam, in Allow messages from: and then, they will go directly to the Inbox. 4. Finally we will save the changes by pressing Save in the upper left part of the screen. Ref: https://www.btactic.com/how-to-include-accounts-and-domains-in-spam-lists-for-zimbra/?lang=en

There are two possibilities to configure the retention of e-mail folders. Mark periods and avoid deleting emails or mark periods so that they are automatically deleted. These can be used individually or jointly. 1. We will go to the folder that we want to retain with right click and press Edit P roperties : 2. At this moment, we will press the tab of Retention , where a configuration menu for this will appear. Here, we can enable both message retention and message disposal : Enable Message Retention , will allow messages from this folder to be retained for the time that we establish, sending us an authorization each time we delete one of these. Likewise, the messages will be deposited in the trash, so we can recover them if necessary Enable Message Disposal , will allow us to temporarily program the messages contained in the folder to be automatically deleted according to the time indicated. They will also be deposited in the recycling bin. Ref: https://www.b...

1. To be able to incorporate external accounts of the type IMAP or POP3 to Zimbra 8’s own web client, we will first go to Preferences in Accounts . Select the option Add External Account , which will display the configuration of this: 2. We will fill this configuration through the data provided by our POP3/IMAP mail provider. When finished, we will press Test Settings , which will indicate with a window if all the data is correct. In case of an error, we will review the entered data. NOTE: For POP3 , we must indicate in Download messages to: if we want the messages to go directly to the Inbox of our Zimbra account, or if we want a new folder to be created to download the emails independently, Folder: … : For IMAP , it will not be possible to download in the Zimbra Inbox, it will always be created after our tray hierarchy, another tray (with the trays that contains our external IMAP account) where all the content that has been displayed will be synchronized. Ref: h...

1. To delegate an account in Zimbra, after having logged in, we will go to Preferences in Accounts . Once there we will look for the button, Add delegate . 2. We will see a screen where we can enter the e-mail account (of our domain or another that is on the same Zimbra server, check with our provider). Here we will define if we want the delegated account to send e-mails as if we were ourselves ( Send As ), or if we want our delegate to send e-mails from us, where the sender will see if a delegate sent the e-mail or e-mail has sent by the original ( Send On Behalf Of ): A notice will also appear on our Zimbra as the notice has been sent. 3. All this will send an e-mail to the delegated account where he will be informed that he have delegated shipping permissions on behalf of that account: 4. At this time we could send e-mails from our delegated account. Once we are ready to do it, we will see a drop-down next to From: , where we can choose if we want to send th...

1. To share any folder to another e-mail, we will first access the account in which this specific folder is located. Press right click on the folder you want, looking for the Share Folder option. 2. Once clicked, the folder sharing menu will appear, where we can choose the account to which we want to give permissions to view the contents of said folder, in the Mail box: Here we can put both an account of the same domain, as that of other domains that are on the same Zimbra mail server (check with our Zimbra mail provider). In addition we can also give the necessary permissions to the recipient of the shared folder, so that you can only view the emails ( Viewer ), that can view, edit, add, move, tag or delete emails from that folder ( Manager ) or that you can act as if that folder were yours ( Admin ). VERY IMPORTANT , If we delete an email from a shared folder, this item will NOT go to our trash, but will be stored in the trash of the source account!: 3. Once you ...

From CLI: ############################ To hide that button in ZWC: $zmprov mc COSname zimbraFeatureChangePasswordEnabled FALSE From GUI: ############################ admin console > Configure > Class of Service > Default (COS) > Features > General Features > Change Password [select/deselect] To prevent changing via CLI: ############################ From CLI: $zmprov mc COSname zimbraPasswordLocked TRUE To prevent changing password via GUI: ############################ From GUI: (admin console > cos or user > advanced tab > password section) Ref: https://forums.zimbra.org/viewtopic.php?t=24144

Method:-1 #################################### # vi passchange.sh #!/bin/sh for i in `zmprov -l getAllAccounts | grep -v "^admin\@\|^wiki\@\|^spam\..*@\|^ham\..*@"` do zmprov modifyAccount $i zimbraPasswordMustChange TRUE done #chown zimbra.zimbra passchange.sh #chmod +x passchange.sh #su zimbra $./passchange.sh Method:-2 #################################### #su zimbra $zmprov ca user@domain.com tempPassword zimbraPasswordMustChange TRUE Method:-3 #################################### #su zimbra $zmprov ma user@domain.com zimbraPasswordMustChange TRUE Method:-4 #################################### #vi passchange.sh #!/bin/bash clear USERS=`su – zimbra -c ‘zmprov -l gaa’`; for ACCOUNT in $USERS; do ACC1=`echo $ACCOUNT | awk -F@ ‘{print $1}’`; ACC=`echo $ACC1 | cut -d ‘.’ -f1`; if [ $ACC == “admin” ] || [ $ACC == “wiki” ] || [ $ACC == “galsync” ] || [ $ACC == “ham” ] || [ $ACC == “spam” ]; then echo “Skipping system account, $NAME…”; else echo “Modifying $ACCOUNT p...

Zimbra allows relaying emails to a specific server only, i.e using zimbraMtaRelayHost. However, there are needs to relay emails per domain basis based on  the sender . For example, you want emails sent by users@domain1.com should be relayed through smtp.domain1.com and users@domain2.com through smtp.domain2.com servers. You can configure it using postfix's "sender_dependent_relayhost_maps". This is an example that has been tested on ZCS 5.0.16 and ZCS 7.1.4 Note: Below settings will not survive zimbra upgrades. Make sure you take backup of config files before upgrading. 1. Add following line to /opt/zimbra/postfix/conf/main.cf Pre 8.5: sender_dependent_relayhost_maps = hash:/opt/zimbra/postfix/conf/bysender 8.5: sender_dependent_relayhost_maps = lmdb:/opt/zimbra/postfix/conf/bysender 2. Create file /opt/zimbra/postfix/conf/bysender and enter your domain names and relay server's IP addresses. @domain1.com [10.10.10.1] @domain2.com [20.20.20.1] You can even add ...

You will need to do all of this as root, so either sudo or elevate to a root shell. Create a file that will contain the domains that will be processed by another server. I used  /etc/postfix/bysender . Open the file  bysender , add the following information: @example . com [ outbound . thirdparty . server . com ] On the left  @example.com  is the domain that you want to have its messages forwarded (relayed) to the outside server The right  [outbound.thirdparty.server.com]  is the server that you want to relay messages to, and yes you need the brackets By the way: You could have one particular user’s messages relayed to a different outside mail server by just putting in the entire e-mail address on the left side Save and Close the  bysender  file. Now we need to hash/map the  bysender  file so that Postfix can use it. Run the following command: postmap / etc / postfix / bysender Now open your Postfix  main.cf  and insert the ...

Creating a delegated admin in Zimbra 1) Create the account with delegated admin privileges as zimbra user. zmprov ca domainadmin@domain password zimbraIsDelegatedAdminAccount TRUE 2) To grant all views (UI components) zmprov ma domainadmin@domain zimbraAdminConsoleUIComponents accountListView zimbraAdminConsoleUIComponents DLListView zimbraAdminConsoleUIComponents aliasListView zimbraAdminConsoleUIComponents resourceListView zimbraAdminConsoleUIComponents COSListView zimbraAdminConsoleUIComponents domainListView zimbraAdminConsoleUIComponents serverListView zimbraAdminConsoleUIComponents zimletListView zimbraAdminConsoleUIComponents adminZimletListView zimbraAdminConsoleUIComponents globalConfigView zimbraAdminConsoleUIComponents globalServerStatusView zimbraAdminConsoleUIComponents helpSearch zimbraAdminConsoleUIComponents saveSearch zimbraAdminConsoleUIComponents mailQueue zimbraAdminConsoleUIComponents backupsView zimbraAdminConsoleUIComponents certsView zimbraAdminConsoleUIComponen...