Search found 7 matches
- Wed Jun 26, 2019 7:03 am
- Forum: Administrators
- Topic: zmswatch high cpu usage
- Replies: 8
- Views: 22210
Re: zmswatch high cpu usage
The patch is very simple and fast to apply, you just need to extract the archive in the right directory and then restart the services, should be only few seconds of down time. The patch applies only to mailboxes servers. It obviously doesn't clean up all the files infected and doesn't close other ba...
- Thu Jun 20, 2019 3:07 pm
- Forum: Administrators
- Topic: temp/upload folder's permissions keep changing
- Replies: 3
- Views: 860
Re: temp/upload folder's permissions keep changing
A vulnerability of Zimbra was found in April, after that a couple of attacks have been fooded. Look at your /opt/zimbra/log folder, if you find an executable file named zmswatch you had been hacked as many other users. If it is so, look at this topic, it would help. https://forums.zimbra.org/viewtop...
- Wed Jun 19, 2019 6:28 am
- Forum: Administrators
- Topic: Unable to change permissions of /opt/zimbra/data/tmp/upload
- Replies: 13
- Views: 5076
Re: Unable to change permissions of /opt/zimbra/data/tmp/upload
The first file is all attacker code, you can delete that or completely remove the content.
For the second one it has been modified, remove all content after clousure of HTML tag
For the second one it has been modified, remove all content after clousure of HTML tag
- Tue Jun 18, 2019 2:12 pm
- Forum: Administrators
- Topic: Unable to change permissions of /opt/zimbra/data/tmp/upload
- Replies: 13
- Views: 5076
Re: Unable to change permissions of /opt/zimbra/data/tmp/upload
In my opinion disallow the user zimbra to run cronjobs will let you set permissions in /opt/zimbra/data/tmp but wont solve the problem. In the zimbra crontab there are usefull stuffs, it's not a good idea to let it disabled for too long. As you have seen the crontab lounch /opt/zimbra/libexec/zmstat...
- Tue Jun 18, 2019 7:34 am
- Forum: Administrators
- Topic: Unable to change permissions of /opt/zimbra/data/tmp/upload
- Replies: 13
- Views: 5076
Re: Unable to change permissions of /opt/zimbra/data/tmp/upload
I had the same issue with one of my server. What I found was two executable files in /opt/zimbra/log/ but I guess you alredy found them. Than the crontab for the user zimbra was changed, in my case almost every line was deleted and in the last two lines there was one lounchin zmswatch, check that to...
- Tue Jun 18, 2019 7:19 am
- Forum: Administrators
- Topic: Unable to change permissions of /opt/zimbra/data/tmp/upload
- Replies: 13
- Views: 5076
Re: Unable to change permissions of /opt/zimbra/data/tmp/upload
I had the same problem. What I found on my server was 2 executable files in /opt/zimbra/log , you have to delete them. The crontab for the user zimbra was changed, chack if there is somthing souspicious there. There where a lot of .jsp files, if you have another server with the same services install...
- Mon Jun 17, 2019 7:38 am
- Forum: Administrators
- Topic: HELP needed, All zimbra services down in web admin but up or running with zmcontrol status
- Replies: 3
- Views: 991
Re: HELP needed, All zimbra services down in web admin but up or running with zmcontrol status
Don't worry, it's just a problem of logging. If the zmcontrol says it's all ok, it actually is. Sometimes I experience the same problem in a multiserver environment. Is it a stand alone server o a multiserver installation? If you have multiple servers you just need to look at the /etc/rsyslog.conf f...