Search found 7 matches

by SamueleERAL
Wed Jun 26, 2019 7:03 am
Forum: Administrators
Topic: zmswatch high cpu usage
Replies: 8
Views: 11388

Re: zmswatch high cpu usage

The patch is very simple and fast to apply, you just need to extract the archive in the right directory and then restart the services, should be only few seconds of down time. The patch applies only to mailboxes servers. It obviously doesn't clean up all the files infected and doesn't close other ba...
by SamueleERAL
Thu Jun 20, 2019 3:07 pm
Forum: Administrators
Topic: temp/upload folder's permissions keep changing
Replies: 3
Views: 533

Re: temp/upload folder's permissions keep changing

A vulnerability of Zimbra was found in April, after that a couple of attacks have been fooded. Look at your /opt/zimbra/log folder, if you find an executable file named zmswatch you had been hacked as many other users. If it is so, look at this topic, it would help. https://forums.zimbra.org/viewtop...
by SamueleERAL
Wed Jun 19, 2019 6:28 am
Forum: Administrators
Topic: Unable to change permissions of /opt/zimbra/data/tmp/upload
Replies: 13
Views: 1948

Re: Unable to change permissions of /opt/zimbra/data/tmp/upload

The first file is all attacker code, you can delete that or completely remove the content.
For the second one it has been modified, remove all content after clousure of HTML tag
by SamueleERAL
Tue Jun 18, 2019 2:12 pm
Forum: Administrators
Topic: Unable to change permissions of /opt/zimbra/data/tmp/upload
Replies: 13
Views: 1948

Re: Unable to change permissions of /opt/zimbra/data/tmp/upload

In my opinion disallow the user zimbra to run cronjobs will let you set permissions in /opt/zimbra/data/tmp but wont solve the problem. In the zimbra crontab there are usefull stuffs, it's not a good idea to let it disabled for too long. As you have seen the crontab lounch /opt/zimbra/libexec/zmstat...
by SamueleERAL
Tue Jun 18, 2019 7:34 am
Forum: Administrators
Topic: Unable to change permissions of /opt/zimbra/data/tmp/upload
Replies: 13
Views: 1948

Re: Unable to change permissions of /opt/zimbra/data/tmp/upload

I had the same issue with one of my server. What I found was two executable files in /opt/zimbra/log/ but I guess you alredy found them. Than the crontab for the user zimbra was changed, in my case almost every line was deleted and in the last two lines there was one lounchin zmswatch, check that to...
by SamueleERAL
Tue Jun 18, 2019 7:19 am
Forum: Administrators
Topic: Unable to change permissions of /opt/zimbra/data/tmp/upload
Replies: 13
Views: 1948

Re: Unable to change permissions of /opt/zimbra/data/tmp/upload

I had the same problem. What I found on my server was 2 executable files in /opt/zimbra/log , you have to delete them. The crontab for the user zimbra was changed, chack if there is somthing souspicious there. There where a lot of .jsp files, if you have another server with the same services install...
by SamueleERAL
Mon Jun 17, 2019 7:38 am
Forum: Administrators
Topic: HELP needed, All zimbra services down in web admin but up or running with zmcontrol status
Replies: 3
Views: 557

Re: HELP needed, All zimbra services down in web admin but up or running with zmcontrol status

Don't worry, it's just a problem of logging. If the zmcontrol says it's all ok, it actually is. Sometimes I experience the same problem in a multiserver environment. Is it a stand alone server o a multiserver installation? If you have multiple servers you just need to look at the /etc/rsyslog.conf f...

Go to advanced search