How to release quarantined emails in 7.0.0??

[odeleon]

Hi all,

7.0.0 includes a new system account for quarantined emails. Email with virus (or hints of them) get deposited in this account. How do you release them?

I tried forwarding them to the destined user but they just enter the loop and get quarantined again.

[mavlenko]

If you actually want to send user a virus (you so kind admin ) get the virus attachment, archive it, and resend to user in archive.

[odeleon]

It's not a virus, it's a legitimate file stored in an encrypted ZIP...which Zimbra's heuristics recognize as a virus.

[mavlenko]

It's not a virus, it's a legitimate file stored in an encrypted ZIP

do you uncheck 'Block encrypted archives' checkbox on AS\AV tab in Global Settings? If you uncheck this, zimbra wouldn't block encrypted archives and couldn't scan inside archive for viruses because it encrypted.

[ewilen]

According to bug 11061, comment 20, quarantining into a mailbox is done, but the method of releasing the mail is covered by Bug 8454 – Quarantined email management functions, and that hasn't been fixed yet.

So you could just uncheck "block encrypted archives" if you'd like. In the general case, I can think of two options, neither of which I've tested on 7.0:

1. Use show original and save the email to a text file. Then see [SOLVED] Releasing quarantined emails

2. Somehow disable (delivery into) the quarantine account using the information in bug 11061, so that quarantined emails are just stored in /opt/zimbra/data/amavisd/quarantine/. (I.e., same behavior as ZCS 6 and earlier.) Possibly you could comment out the two lines in /opt/zimbra/conf/amavisd.conf.in that are mentioned in comment #30. If that works, proceed as above.

[liverpoolfcfan]

Presumably for now, you need to go into the admin tool, go into the quarantine account, and click View Mail (or share the Quarantine account Inbox with your trusted admins so that they can see it from their own web client)

From there, you should be able to see the quarantined email, save off the affected attachment (assuming your local anti-virus doesn't stop you doing so) then remove the attachment and forward the email to the original intended recipient.

You will have to put the attachment on a network share or somewhere else the recipient can access it.

I haven't tested this method as yet, as I haven't had anything get quarantined since I upgraded - but I assume it should work.

Alternatively, you could use this method that I have been using for the past year on ZCS 6.0.x

Easier Handling of Banned Content and Bad Header Messages