Results 1 to 6 of 6

Thread: ZCS Security

  1. #1
    Join Date
    Aug 2011
    Posts
    4
    Rep Power
    4

    Post ZCS Security

    Dear all,

    Where can I find a reference, about the security of Zimbra. Especially regarding the security of users' email storage on the server, whether encrypted or not?
    I need this to convince my organization to use Zimbra, I am happy to fund if there are other references regarding all security Zimbra.
    Thank you.

  2. #2
    Join Date
    Dec 2006
    Location
    Minneapolis MN
    Posts
    777
    Rep Power
    9

    Default

    Do you have more specific questions regarding security?

    Email is stored on the server in plain text, not encrypted. If you want to encrypt it, you will have to use a filesystem underneath the mailbox store that will do the encryption.
    01 Networks, LLC / Cybernetik.net
    Zimbra NE and OSS Cloud Hosting
    Shared Web Hosting
    Consulting Services

  3. #3
    Join Date
    Aug 2011
    Posts
    4
    Rep Power
    4

    Default

    then, how does zimbra store emails? What is stored in a database like mysql, and what to do with ldap.

  4. #4
    Join Date
    Dec 2006
    Location
    Minneapolis MN
    Posts
    777
    Rep Power
    9

    Default

    LDAP = Directory and configuration
    MySQL = Folder and message metadata
    Disk = Actual complete messages, and indexes for mailboxes for searching
    01 Networks, LLC / Cybernetik.net
    Zimbra NE and OSS Cloud Hosting
    Shared Web Hosting
    Consulting Services

  5. #5
    Join Date
    Aug 2011
    Posts
    4
    Rep Power
    4

    Default

    Then, where should I start to make my email server completely secure, at least we have done is supposed to do. Given that the data is sent via email of important data, I'm afraid the data will be lost or stolen, either at the server or when the data was sent.

  6. #6
    Join Date
    Dec 2006
    Location
    Minneapolis MN
    Posts
    777
    Rep Power
    9

    Default

    That's not covered in any kind of Zimbra documentation, since that issue isn't really related to Zimbra specifically. You could extrapolate that to any application you install on a server.

    • You need to ensure the server is in a secure facility.
    • Encrypt the file-system which Zimbra resides on (Google search file system encryption for your particular operating system to look for options). If your file system is on a SAN, you may have more commercial options.
    • Ensure your firewalls are set up to block ports according to Zimbra documentation (see the Administrators guide)


    None of this addresses the fact that email is in plain-text to the external world. The new version of Zimbra supports S/MIME in the licensed version, so you may want to read up on how S/MIME works. If you enforce S/MIME in your company, then you may not have to worry about file system encryption above.
    01 Networks, LLC / Cybernetik.net
    Zimbra NE and OSS Cloud Hosting
    Shared Web Hosting
    Consulting Services

Similar Threads

  1. Scaling ZCS regionally - performance solutions
    By j2b in forum Administrators
    Replies: 5
    Last Post: 05-27-2011, 09:22 AM
  2. Trouble Sending mail - All Messages deferred!
    By SiteDiscovery in forum Administrators
    Replies: 7
    Last Post: 09-03-2009, 05:52 AM
  3. Replies: 41
    Last Post: 10-29-2007, 03:36 PM
  4. ZCS 3.2 Beta Available
    By KevinH in forum Announcements
    Replies: 31
    Last Post: 07-07-2006, 04:46 PM

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •