Relay from internal network

[thiagopramos]

Hi, i´m newbee in zimbra.
I have a relay open for internal network.
Some workstation be infect by virus and send a mount of spams.
I find in administration console, but all mails from my internal network have send from 127.0.0.1.
How log can help me?

[uxbod]

Welcome to the forums

Well they will show that IP address but there will also be other ones in the headers. It would help if you were to post the headers from one of the emails and we can decode it for you.

[veronica]

You can find client IP addres from which they are sending spams in zimbra.log. That can be usefull in finding the affected machine.

[SamTzu]

You should check Zimbra's trusted network setting.
If it includes your firewall/gateways internal network address you have configured it to be an open relay. Congratulations.

If your local area network is in LAN and your network is something like...
192.168.0.x or 10.x.x.x then you should definitely NOT include your firewall address in the trusted network.

For some obscure reason Zimbra's default configuration is very SPAM friendly when it comes to local area networks (LAN).

Easiest way to fix this is simply put an /32 at the end of the LAN address in trusted network setting. This will make the Zimbra server only trust it self. (And those who log in to it with proper credentials.)

[uxbod]

Originally Posted by SamTzu

For some obscure reason Zimbra's default configuration is very SPAM friendly when it comes to local area networks (LAN).

Local by nature should mean you trust your people and have a grasp of what they are doing aswell