Stop Zimbra from randomly making https requests to external servers

[Exocomp]

I get the following requests out on the server:

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 1 10.0.1.99:40158 54.165.59.50:443 SYN_SENT 3096/java
tcp 0 1 10.0.1.99:40158 52.30.151.10:443 SYN_SENT 3096/java

Note the PID is 3096, checking this pid shows it is Zimbra

USER PID %CPU %MEM START TIME COMMAND
zimbra 3096 0.3 23.5 Jul06 7:42 /opt/zimbra/common/bin/java

What are these requests and how can I stop it ?

[jorgedlcruz]

Hi,
Both looks like the call to home Zimbra and Zextras has, Zimbra it's possible is the auto-update on the Admin Console, and the second IP is Zextras which I assume you have Chat and Drive installed right?

Best regards

[Exocomp]

Hi Jorge,

Thanks for the quick response, you are right I have updates enabled on the configuration options. But how do I disable it? I don't see an option to disable it.

Also, you are right I have Chat and Drive installed, I never use them though, do they must make external web requests?

[jorgedlcruz]

Hello,
Other than block the IP on the outbound Firewall, we don't have anything at the moment to stop that calls to home, let me discuss it internally, maybe a LDAP attribute is the best

[Exocomp]

The firewall blocks the attempts but it is persistent, it floods/retries for around 200+ times every time it runs before it gives up.

I set the retry interval to 9999 days so hopefully that stops it.

[Exocomp]

Regarding the "Zextras", I disabled the "com_zextras_chat_open" and "com_zextras_drive_open" zimlets through the admin interface but I still get these (over 125+ attempts before it gives up):

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 1 10.0.1.99:46070 52.30.151.10:443 SYN_SENT 3117/java

USER PID %CPU %MEM START TIME COMMAND
zimbra 3117 0.3 23.5 Jul06 7:42 /opt/zimbra/common/bin/java

How do I disable drive/chat?

[jorgedlcruz]

Hello,
You need to make sure you don't have the .jar in the drive and chat folders, those are ones calling home.

Best regards

[Exocomp]

Hi Jorge,

Thanks to your help, I was able to figure out what exactly was causing the issue, it is the following jar:

/opt/zimbra/lib/ext/openchat/openchat.jar

Specifically it is the following class:

com\zextras\modules\chat\ChatExtension

The http call is hard coded in that class with the endpoint to "https://updates.zextras.com/openchat". That endpoint is actually returning a 404 based on my tests so it is broken to begin with.

Anyway, my issue is resolved. Thanks for your help.