Search found 31 matches

by 7310pyperdown
Thu May 08, 2014 2:21 pm
Forum: Administrators
Topic: Wiping queues from command line?
Replies: 5
Views: 2550

Wiping queues from command line?

I realize this is an old thread, but what I need to do (on hopefully rare occasions) is clear all queues BY USER. I have a script that looks for SPAMMY behavior (over 5 messages per minute) and locks the user's account and emails me so we can act on it. I have found with our latest phish victim that...
by 7310pyperdown
Thu May 01, 2014 7:43 pm
Forum: Administrators
Topic: Identify compromised accounts
Replies: 18
Views: 8156

Identify compromised accounts

I ended up with something very similar (in the grep/sed/awk commands)... added a logrotation at the end, so that th euser's account can get unlocked once appropriate measures are taken (strung up by thumbs, teaching moment exploited, password changed, etc) #!/bin/bash # checks log file and gets a co...
by 7310pyperdown
Thu May 01, 2014 6:49 pm
Forum: Administrators
Topic: Identify compromised accounts
Replies: 18
Views: 8156

Identify compromised accounts

Just got hosed by this exact situation today, and my booby-trap didn't catch it. Will take a look-see at the sasl_username and see if that proves more effective. If you have any code for this I'd sure love to see this. [quote user="drwho18"]The script posted above is a good idea, however i...
by 7310pyperdown
Thu Apr 10, 2014 2:34 pm
Forum: Administrators
Topic: ignore the X-SPAM header (we have an upstream spam filter)?
Replies: 1
Views: 1345

ignore the X-SPAM header (we have an upstream spam filter)?

How can I get Zimbra to ignore the X-SPAM: Yes headers? I've got AS/AV off, have restarted services, but still no joy. When my users allow a false positive through (via the upstream product's interface), it still ends up in their junk folders. The upstream product does not "un-set" the X-S...
by 7310pyperdown
Mon Jul 08, 2013 6:42 pm
Forum: Administrators
Topic: Identify compromised accounts
Replies: 18
Views: 8156

Identify compromised accounts

I modded the script to only lock active accounts. runs a bit faster. Otherwise there tend to be a lot of hits and redundant notification emails, and the zmprov ma command is pretty slooooooow.
by 7310pyperdown
Thu Jun 27, 2013 6:05 pm
Forum: Administrators
Topic: i'm in a big spam trouble ! pls help me !
Replies: 7
Views: 1616

i'm in a big spam trouble ! pls help me !

You need to look at your zimbra.log files, possibly going back a couple of days. If it's not in the current log you may need to look at zimbra.log.0, or zimbra.log.[1-4].gz This fragment checks the log file, and counts the number of connections in each recorded timestamp minute ie 5 12:48 ignorant_u...
by 7310pyperdown
Thu Jun 27, 2013 5:49 pm
Forum: Administrators
Topic: compromised accounts issue
Replies: 4
Views: 2057

compromised accounts issue

This is a bit brute force, but it works. I have it set to run every 5 minutes in a cron job. If an account authenticates more than 5 times in a minute, the account is locked and an email sent to the admin. I'm a bit irritated with users who blithely go clicking on whatever and don't pay attention. U...
by 7310pyperdown
Thu Jun 27, 2013 5:40 pm
Forum: Administrators
Topic: Identify compromised accounts
Replies: 18
Views: 8156

Identify compromised accounts

I'm giving this script i wrote this am a try. The system needs to be able to protect itself from obvious abuse. More than 5 authenticated sessions in a minute is likely evidence of abuse. So once identified we lock the account. Since they most likely fell for a phishing mail and should know better I...
by 7310pyperdown
Mon Jun 24, 2013 10:57 am
Forum: Administrators
Topic: parsing error importing calendar from one user to another
Replies: 3
Views: 927

parsing error importing calendar from one user to another

[quote user="7531prashant"]Could you please elaborate the case in more details. How you are exporting? Whether the calendar of the person is shared? Are you directly accessing his account? Know how with detailed explaination would help in understanding the problem.[/QUOTE] Using import exp...
by 7310pyperdown
Fri Jun 21, 2013 1:18 pm
Forum: Administrators
Topic: parsing error importing calendar from one user to another
Replies: 3
Views: 927

parsing error importing calendar from one user to another

We had an employee leave and I am attempting to get their calendar moved to another user. Exported just fine, but when I import all I get is "Parsing Error". How would I go about troubleshooting this?
Release 7.2.1_GA_2790.UBUNTU8_64 UBUNTU8_64 FOSS edition.
(Yes I know I need to upgrade)