Many Zimbra administrators have setup TLS encryption to protect their users’ login credentials and email in transit. But TLS is a complex standard, and often unknowingly misconfigured. Deploying TLS correctly does not require a university degree in cryptography, but rather a working knowledge of some key concepts and awareness of pitfalls to avoid. And, with […]
Author Archive | Barry de Graaff
Are you using zen.spamhaus.org or dbl.spamhaus.org for fighting spam? Pay attention!
Spamhaus is making some changes in their policy enforcement, from their website: Are you currently using the Spamhaus Project’s DNS Blocklists (DNSBLs)? Do you access them via the Public Mirrors, for example, query “sbl.spamhaus.org” or “zen.spamhaus.org”? Do you use Cloudflare’s DNS? If you’ve answered “yes” to all three of those questions, you need to make […]
Configuring Fail2Ban on Zimbra
This article is a how-to guide on installing Fail2Ban to block attacking hosts using a null route or blackhole routes. This can help mitigate brute force attacks on Zimbra. Especially brute force attacks on SMTP are very common. Prerequisite: Fail2ban has been tested in combination with netfilter-persistent and iptables. If you use ufw or firewalld […]
Nextcloud Talk Zimlet
Zimbra loves Nextcloud! And that is why Zimbra and Nextcloud work together to make both products integrate seamlessly. The Nextcloud Talk Zimlet add a button in the new appointment window that allows you to create a Nextcloud Talk meeting from the Zimbra Calendar. Screenshots Installing This Zimlet depends on the installation of Nextcloud Zimlet for […]
Authentication Bypass in MailboxImportServlet vulnerability
Zimbra 8.8.15 patch 33 and Zimbra 9.0.0 patch 26 contain an important security update that fixes an authentication bypass in MailboxImportServlet (CVE-2022-37042 and CVE-2022-27925). If you are running a Zimbra version that is older than Zimbra 8.8.15 patch 33 or Zimbra 9.0.0 patch 26 you should update to the latest patch as soon as possible. […]
Zimbra with Let’s Encrypt Certificates a step-by-step guide (update)
By Barry de Graaff on August 10, 2022 in Community, Security & Privacy, Zimbra Server, Zimbra SkillZ
This article is a step-by-step instruction on setting up a Zimbra with Let’s Encrypt certificates. If you are running a multi server installation of Zimbra it is recommended you set-up a dedicated VM for obtaining the Let’s Encrypt certificate and follow this blog. Prerequisites This guide assumes you are using Ubuntu 20 and you have […]