Zimbra Hackked

[aspiro]

Hi I really need some help with this. We have been running zimbra without a problem for the last year or so. Today I started to get complaints that we were not being received or sent (no error messages, emails just never arrived).

I took a look at the email queues and I had 6000 deffered, 4000 incoming and about 20000 active.

I have stopped postfix, and blocked all access to the zimbra server at the firewall level.

I really need help in determining my next steps.


Thanks in advance...

[phoenix]

I'd suggest you start with some of the following threads:

site:zimbra.com +"compromised account" - Yahoo! Search Results
Hacked account sending spam
site:zimbra.com +hacked - Yahoo! Search Results

You need to determine if it's a compromised account and perhaps implement strong password settings for Zimbra accounts.

[aspiro]

Hi and thanks for your help.

I ran some tests and it looks like I had accidently configured zimbra as an open relay. I undid what I did about a month ago and voila relaying stopped.


Thanks again.