Search found 31 matches
- Thu May 08, 2014 2:21 pm
- Forum: Administrators
- Topic: Wiping queues from command line?
- Replies: 5
- Views: 2553
Wiping queues from command line?
I realize this is an old thread, but what I need to do (on hopefully rare occasions) is clear all queues BY USER. I have a script that looks for SPAMMY behavior (over 5 messages per minute) and locks the user's account and emails me so we can act on it. I have found with our latest phish victim that...
- Thu May 01, 2014 7:43 pm
- Forum: Administrators
- Topic: Identify compromised accounts
- Replies: 18
- Views: 8162
Identify compromised accounts
I ended up with something very similar (in the grep/sed/awk commands)... added a logrotation at the end, so that th euser's account can get unlocked once appropriate measures are taken (strung up by thumbs, teaching moment exploited, password changed, etc) #!/bin/bash # checks log file and gets a co...
- Thu May 01, 2014 6:49 pm
- Forum: Administrators
- Topic: Identify compromised accounts
- Replies: 18
- Views: 8162
Identify compromised accounts
Just got hosed by this exact situation today, and my booby-trap didn't catch it. Will take a look-see at the sasl_username and see if that proves more effective. If you have any code for this I'd sure love to see this. [quote user="drwho18"]The script posted above is a good idea, however i...
- Thu Apr 10, 2014 2:34 pm
- Forum: Administrators
- Topic: ignore the X-SPAM header (we have an upstream spam filter)?
- Replies: 1
- Views: 1354
ignore the X-SPAM header (we have an upstream spam filter)?
How can I get Zimbra to ignore the X-SPAM: Yes headers? I've got AS/AV off, have restarted services, but still no joy. When my users allow a false positive through (via the upstream product's interface), it still ends up in their junk folders. The upstream product does not "un-set" the X-S...
- Mon Jul 08, 2013 6:42 pm
- Forum: Administrators
- Topic: Identify compromised accounts
- Replies: 18
- Views: 8162
Identify compromised accounts
I modded the script to only lock active accounts. runs a bit faster. Otherwise there tend to be a lot of hits and redundant notification emails, and the zmprov ma command is pretty slooooooow.
- Thu Jun 27, 2013 6:05 pm
- Forum: Administrators
- Topic: i'm in a big spam trouble ! pls help me !
- Replies: 7
- Views: 1616
i'm in a big spam trouble ! pls help me !
You need to look at your zimbra.log files, possibly going back a couple of days. If it's not in the current log you may need to look at zimbra.log.0, or zimbra.log.[1-4].gz This fragment checks the log file, and counts the number of connections in each recorded timestamp minute ie 5 12:48 ignorant_u...
- Thu Jun 27, 2013 5:49 pm
- Forum: Administrators
- Topic: compromised accounts issue
- Replies: 4
- Views: 2062
compromised accounts issue
This is a bit brute force, but it works. I have it set to run every 5 minutes in a cron job. If an account authenticates more than 5 times in a minute, the account is locked and an email sent to the admin. I'm a bit irritated with users who blithely go clicking on whatever and don't pay attention. U...
- Thu Jun 27, 2013 5:40 pm
- Forum: Administrators
- Topic: Identify compromised accounts
- Replies: 18
- Views: 8162
Identify compromised accounts
I'm giving this script i wrote this am a try. The system needs to be able to protect itself from obvious abuse. More than 5 authenticated sessions in a minute is likely evidence of abuse. So once identified we lock the account. Since they most likely fell for a phishing mail and should know better I...
- Mon Jun 24, 2013 10:57 am
- Forum: Administrators
- Topic: parsing error importing calendar from one user to another
- Replies: 3
- Views: 933
parsing error importing calendar from one user to another
[quote user="7531prashant"]Could you please elaborate the case in more details. How you are exporting? Whether the calendar of the person is shared? Are you directly accessing his account? Know how with detailed explaination would help in understanding the problem.[/QUOTE] Using import exp...
- Fri Jun 21, 2013 1:18 pm
- Forum: Administrators
- Topic: parsing error importing calendar from one user to another
- Replies: 3
- Views: 933
parsing error importing calendar from one user to another
We had an employee leave and I am attempting to get their calendar moved to another user. Exported just fine, but when I import all I get is "Parsing Error". How would I go about troubleshooting this?
Release 7.2.1_GA_2790.UBUNTU8_64 UBUNTU8_64 FOSS edition.
(Yes I know I need to upgrade)
Release 7.2.1_GA_2790.UBUNTU8_64 UBUNTU8_64 FOSS edition.
(Yes I know I need to upgrade)