By keeping spambots away, postscreen leaves more SMTP server processes available for legitimate clients and delays the onset of server overload conditions.

Configuring

To configure Postscreen you first need to create an account at Spamhaus and obtain a DQS query key. Then you can configure Postscreen as follows, replace your-dqs-key-here with your actual Spamhaus DQS key:

zmprov mcf zimbraMtaPostscreenAccessList permit_mynetworks
zmprov mcf zimbraMtaPostscreenBareNewlineAction ignore
zmprov mcf zimbraMtaPostscreenBareNewlineEnable no
zmprov mcf zimbraMtaPostscreenBareNewlineTTL 30d
zmprov mcf zimbraMtaPostscreenBlacklistAction ignore
zmprov mcf zimbraMtaPostscreenCacheCleanupInterval 12h
zmprov mcf zimbraMtaPostscreenCacheRetentionTime 7d
zmprov mcf zimbraMtaPostscreenCommandCountLimit 20
zmprov mcf zimbraMtaPostscreenDnsblAction enforce
zmprov mcf zimbraMtaPostscreenDnsblSites 'b.barracudacentral.org=127.0.0.2*7' zimbraMtaPostscreenDnsblSites 'your-dqs-key-here.zen.dq.spamhaus.net=127.0.0.[10;11]*8' zimbraMtaPostscreenDnsblSites 'your-dqs-key-here.zen.dq.spamhaus.net=127.0.0.[4..7]*6' zimbraMtaPostscreenDnsblSites 'your-dqs-key-here.zen.dq.spamhaus.net=127.0.0.3*4' zimbraMtaPostscreenDnsblSites 'your-dqs-key-here.zen.dq.spamhaus.net=127.0.0.2*3' zimbraMtaPostscreenDnsblSites 'list.dnswl.org=127.0.[0..255].0*-2' zimbraMtaPostscreenDnsblSites 'list.dnswl.org=127.0.[0..255].1*-3' zimbraMtaPostscreenDnsblSites 'list.dnswl.org=127.0.[0..255].2*-4' zimbraMtaPostscreenDnsblSites 'list.dnswl.org=127.0.[0..255].3*-5' zimbraMtaPostscreenDnsblSites 'bl.mailspike.net=127.0.0.2*5' zimbraMtaPostscreenDnsblSites 'bl.mailspike.net=127.0.0.[10;11;12]*4' zimbraMtaPostscreenDnsblSites 'wl.mailspike.net=127.0.0.[18;19;20]*-2' zimbraMtaPostscreenDnsblSites 'dnsbl.sorbs.net=127.0.0.10*8' zimbraMtaPostscreenDnsblSites 'dnsbl.sorbs.net=127.0.0.5*6' zimbraMtaPostscreenDnsblSites 'dnsbl.sorbs.net=127.0.0.7*3' zimbraMtaPostscreenDnsblSites 'dnsbl.sorbs.net=127.0.0.8*2' zimbraMtaPostscreenDnsblSites 'dnsbl.sorbs.net=127.0.0.6*2' zimbraMtaPostscreenDnsblSites 'dnsbl.sorbs.net=127.0.0.9*2'
zmprov mcf zimbraMtaPostscreenDnsblTTL 5m
zmprov mcf zimbraMtaPostscreenDnsblThreshold 8
zmprov mcf zimbraMtaPostscreenDnsblTimeout 10s
zmprov mcf zimbraMtaPostscreenDnsblWhitelistThreshold 0
zmprov mcf zimbraMtaPostscreenGreetAction enforce
zmprov mcf zimbraMtaPostscreenGreetTTL 1d
zmprov mcf zimbraMtaPostscreenNonSmtpCommandAction drop
zmprov mcf zimbraMtaPostscreenNonSmtpCommandEnable no
zmprov mcf zimbraMtaPostscreenNonSmtpCommandTTL 30d
zmprov mcf zimbraMtaPostscreenPipeliningAction enforce
zmprov mcf zimbraMtaPostscreenPipeliningEnable no
zmprov mcf zimbraMtaPostscreenPipeliningTTL 30d
zmprov mcf zimbraMtaPostscreenWatchdogTimeout 10s
zmprov mcf zimbraMtaPostscreenWhitelistInterfaces static:all
zmprov mcf zimbraMtaPostscreenDnsblReplyMap lmdb:/opt/zimbra/conf/dnsbl-reply

Next you have to create a file /opt/zimbra/conf/dnsbl-reply  with the following content:

'your-key-here'.sbl.dq.spamhaus.net sbl.spamhaus.org
'your-key-here'.xbl.dq.spamhaus.net xbl.spamhaus.org
'your-key-here'.pbl.dq.spamhaus.net pbl.spamhaus.org
'your-key-here'.zen.dq.spamhaus.net zen.spamhaus.org
'your-key-here'.dbl.dq.spamhaus.net dbl.spamhaus.org
'your-key-here'.zrd.dq.spamhaus.net zrd.spamhaus.org

Don’t forget to run postmap /opt/zimbra/conf/dnsbl-reply command. Please note that the syntax for /opt/zimbra/conf/dnsbl-reply is not the same as/opt/zimbra/conf/dnsbl-reply-map used in https://wiki.zimbra.com/wiki/Anti-spam.

Restart the MTA to load the changes, as user Zimbra:

zmmtactl restart

For the latest configuration on Spamhaus go to your Spamhaus Portal click Products -> DQS in the top menu, then click the Manual tab and refer to section 3.1.2 Configuring Postfix.

Further reading

• https://www.zimbra.com/business-email-collaboration/secure-email-features/email-security-postscreen/
• https://wiki.zimbra.com/wiki/Zimbra_Collaboration_Postscreen
• https://blog.zimbra.com/2017/09/reduce-incoming-spam-overall-mta-overload-using-postscreen/
• https://www.postfix.org/POSTSCREEN_README.html#enable

The post Did you know? Zimbra Postscreen provides additional protection against mail server overload appeared first on Zimbra : Blog.

Zimbra Desktop provides a seamless way to access your Zimbra content when connectivity is limited. It’s an app that you install on your computer (Windows or Mac) so you can read your emails, reply or forward an email, compose new ones, and check your calendar. Zimbra syncs automatically and delivers any new email in/out of your mailbox as soon as your device goes online.

Zimbra Desktop has all the same functionality as Zimbra’s Modern UI.

Running out of storage quota on your mailbox?

You may free up space on your mailbox by moving some of the emails to the local storage. The emails moved to local storage will be accessible via the Zimbra Desktop app.

Archiving regularly helps free space on your mail servers.

Can I archive my old emails automatically?

Yes, the Auto-Archive feature in Zimbra Desktop help you move old emails from the mail server storage to the Local Storage. This feature is set to auto-archive emails older than 30-days, but you can adjust this to any time you want.

How do I enable the Auto-Archive feature?

Follow these steps to enable it:

1. Go to Settings.
2. In General → Storage, select the Enable
3. By default, mails older than 30 days will be archived. If you need to change the days, update Auto-archive emails older than textbox field.
4. Click Save.
5. Zimbra Desktop App needs to be restarted to start the archiving of messages.

How do I know if my emails are being auto-archived?

Once the Auto-Archive feature is enabled, Zimbra Desktop App must be restarted to start the auto-archiving process. Depending upon the data to be archived, the process may take some time. The mails matching the auto-archive criteria will be moved from Inbox to Local Folders.

Can I send emails securely with Zimbra Desktop?

Yes, Zimbra Desktop app supports S/MIME functionality. You can send Signed or Signed and Encrypted emails to other users.

How to change the Zimbra Server URL in Zimbra Desktop App

When the Zimbra Desktop App is opened for the first time, user will have to provide the Zimbra Server URL to connect to the Zimbra server.

If the user needs to change the Zimbra Server URL in the future, user must change it in the following file:

• Windows : C:\Users\[USER-NAME]\AppData\Roaming\@zimbra\electron-app\server_prefs.json
• Mac : /Users/[USER-NAME]/Library/Application Support/@zimbra/electron-app/server_prefs.json

The post Did you Know? Zimbra Desktop Auto-Archive feature and more appeared first on Zimbra : Blog.

If you have applied the steps from the Cipher Suites wiki before, you can run the following commands as user zimbra to apply the recent changes.

zmprov -l mcf zimbraReverseProxySSLCiphers '!DH:!EDH:!ADH:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384'
zmproxyctl restart

postconf -e tls_medium_cipherlist='!DH:!EDH:!ADH:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384'
postconf -e tls_preempt_cipherlist=no
zmmtactl restart

With this change we have added !DH:!EDH:!ADH: that will explicitly disable Diffie-Hellman. In some cases with some certificate providers Diffie-Hellman will already be disabled regardless of the configured cipher list. It does not hurt to configure it, but you can check your current TLS security by running a website test at internet.nl.

The post Update Zimbra TLS cipher suites to disable Diffie-Hellmann appeared first on Zimbra : Blog.

• Identity and credit card information theft
• Theft of proprietary data
• Precise phishing attacks
• Ransomware
• Malicious attachments
• Being hacked

We have written the end-user oriented email security checklist to help you raise awareness for (email) account security.

The post Email Security Protect your email account and data appeared first on Zimbra : Blog.

Zimbra 9.0.0 Kepler Patch 29 and 8.8.15 James Prescott Joule Patch 36 are here.

This patch fixes 2 issues that where introduced with Kepler 9.0.0-Patch-28 & 8815 Joule-Patch-35 Patch.

• In the previous patch ClamAV was upgraded to the latest upstream version, unfortunately this broke attachment scanning, this new patch restores the attachment scanning functionality. Should you have disabled attachment scanning you can re-enable it by running:

zmprov ms `zmhostname` zimbraAttachmentsScanEnabled TRUE
zmcontrol restart

• In the previous patch spell and convertd services failed to start on mailstore nodes in a multi node setup. This has been fixed by recompiling Apache with existing PCRE library.

Please refer to the release notes for the patch installation on Red Hat and Ubuntu platforms.

Release Notes:

• Zimbra 9.0.0 Patch-29
• Zimbra 8.8.15 Patch-36

Please refer Zimbra Releases for latest releases and Zimbra Security Center for security updates.

Thanks,
Your Zimbra Team

The post NEW! Zimbra Patches: 9.0.0 Patch 29 + 8.8.15 Patch 36 appeared first on Zimbra : Blog.

Enable SSO for Users Accessing Zimbra through SafeNet Trusted Access (STA)

Configuring STA for Zimbra is a 3-step process:

1. Setup STA
2. Setup Zimbra
3. Verify authentication

Prerequisites:

• Zimbra up and running
• Download the Identity Provider (IdP) certificate from the SafeNet Trusted Access console and save the certificate in your machine local directory
• Configure SSL certificate and Domain on the Zimbra server

Click here for the steps to activate Zimbra in STA.

Thanks,
Your Zimbra Team

The post Zimbra Now Works with Thales’ SafeNet Trusted Access appeared first on Zimbra : Blog.

//Load components from Zimbra
import { createElement } from "preact";
import dompurify from 'dompurify';

//Create function by Zimbra convention
export default function Zimlet(context) {
    const { plugins } = context;
    const exports = {};

    exports.init = function init() {
        let clean = dompurify.sanitize('<b>hello there</b>');
        console.log(clean); //prints: <b>hello there</b>
        clean = dompurify.sanitize('<img src=x onerror=alert(1)//>');
        console.log(clean);//prints: <img src="x">
    };

    return exports;
}

The post How to use DOMPurify in your Zimlet for XSS sanitizing appeared first on Zimbra : Blog.