I am suspecting that our mail server running Zimbra got hacked.
Fortunately it is running in a virtual server so setting up a new one is not hard.
My first question is: If I migrate to a new server using "zmrestore" as instructed in Moving ZCS to New Server - Zimbra :: Wiki
Will this only restore pure data and NO scripts / executables?
Since we got hacked I ONLY want data to be moved to the new server, as you all probably understand :-)
Me second question is: If I install the latest Zimbra, will I be able to migrate my data as instructed in the above mentioned link?
The hacked server is running Debian 4. I havent had time to examine it further but will do that later on. I suspect it got hacked since my firewall logs shows that it accessed a IP on port 80 (which turned out to be a webmail server) and another IP on port 123... dunno what a Zimbra does on 123 on a PC that is placed on a home broadband IP-range but Im pretty sure that that behaviour is not hardcoded into the source :-)
Zimra version is Release 5.0.4_GA_2101.DEBIAN4.0 DEBIAN4.0 FOSS edition
All replies are happely accepted but I would really appreciate if I got answers from experienced admins too. Maybe ZImbra staff too? :-)