The patch is very simple and fast to apply, you just need to extract the archive in the right directory and then restart the services, should be only few seconds of down time. The patch applies only to mailboxes servers. It obviously doesn't clean up all the files infected and doesn't close other ba...

A vulnerability of Zimbra was found in April, after that a couple of attacks have been fooded. Look at your /opt/zimbra/log folder, if you find an executable file named zmswatch you had been hacked as many other users. If it is so, look at this topic, it would help. https://forums.zimbra.org/viewtop...

The first file is all attacker code, you can delete that or completely remove the content.
For the second one it has been modified, remove all content after clousure of HTML tag

In my opinion disallow the user zimbra to run cronjobs will let you set permissions in /opt/zimbra/data/tmp but wont solve the problem. In the zimbra crontab there are usefull stuffs, it's not a good idea to let it disabled for too long. As you have seen the crontab lounch /opt/zimbra/libexec/zmstat...

I had the same issue with one of my server. What I found was two executable files in /opt/zimbra/log/ but I guess you alredy found them. Than the crontab for the user zimbra was changed, in my case almost every line was deleted and in the last two lines there was one lounchin zmswatch, check that to...

I had the same problem. What I found on my server was 2 executable files in /opt/zimbra/log , you have to delete them. The crontab for the user zimbra was changed, chack if there is somthing souspicious there. There where a lot of .jsp files, if you have another server with the same services install...

Don't worry, it's just a problem of logging. If the zmcontrol says it's all ok, it actually is. Sometimes I experience the same problem in a multiserver environment. Is it a stand alone server o a multiserver installation? If you have multiple servers you just need to look at the /etc/rsyslog.conf f...