This article is a how-to guide on installing Fail2Ban to block attacking hosts using a null route or blackhole routes. This can help mitigate brute force attacks on Zimbra. Especially brute force attacks on SMTP are very common. Prerequisite: Fail2ban has been tested in combination with netfilter-persistent and iptables. If you use ufw or firewalld […]
Archive | Security & Privacy
Authentication Bypass in MailboxImportServlet vulnerability
Zimbra 8.8.15 patch 33 and Zimbra 9.0.0 patch 26 contain an important security update that fixes an authentication bypass in MailboxImportServlet (CVE-2022-37042 and CVE-2022-27925). If you are running a Zimbra version that is older than Zimbra 8.8.15 patch 33 or Zimbra 9.0.0 patch 26 you should update to the latest patch as soon as possible. […]
Zimbra with Let’s Encrypt Certificates a step-by-step guide (update)
By Barry de Graaff on August 10, 2022 in Community, Security & Privacy, Zimbra Server, Zimbra SkillZ
This article is a step-by-step instruction on setting up a Zimbra with Let’s Encrypt certificates. If you are running a multi server installation of Zimbra it is recommended you set-up a dedicated VM for obtaining the Let’s Encrypt certificate and follow this blog. Prerequisites This guide assumes you are using Ubuntu 20 and you have […]
Deprecation of the “X-XSS-Protection” header
Hello Zimbra Customers, Partners & Friends, In the past Zimbra recommended to set the X-XSS-Protection HTTP response header. This header used to enable additional protection against cross-site scripting (XSS) attacks in some web browsers. However this header is now deprecated and support is removed from most browsers. In case you have configured Zimbra to use […]
Implementing Custom Authentication using a Zimbra extension (updated)
By Barry de Graaff on June 15, 2022 in Community, Open Source, Security & Privacy, Zimbra SkillZ, Zimlets
In this article you will learn how to implement Custom Authentication using a Zimbra extension. The Java project and source code can be found at https://github.com/Zimbra/zimbra-custom-authentication. Take a look at https://github.com/Zimbra/zm-extension-guide if you are new to Java or building Zimbra extensions. The zm-extension-guide covers all the things needed to build the Custom Authentication extension. Zimbra […]
Zimbra SkillZ: How to use Zimbra with multiple HTTPS domains (Server Name Indication)
By Barry de Graaff on June 1, 2022 in Community, PowerTips – Admins, Security & Privacy, Zimbra Server, Zimbra SkillZ
This article is a short how-to on making your Zimbra reachable via multiple HTTPS domains. This will allow your users to reach Zimbra using different URL’s such as: https://mail.zimbra.com and https://mail.zimbra.org. Set-up initial TLS certificate Set-up Zimbra to work with the fist HTTPS domain. Install the certificate obtained from your Certificate Authority by using one […]