Zimbra Login
Karla Pearcy
There are reports that Zimbra overwrites the main.cf configuration upon service restart. To avoid this, mark /opt/zimbra/postfix/conf/main.cf as read-only. Note however, setting to read-only prevents any further changes. If you encounter problems when reverting the main.cf file or are unable to change anything, contact Barracuda Networks Technical Support.
We have one mail server zimbra, and want to migrate some users from Zimbra to o365.
We could migrate for example 10 users from zimbra to o365 (by imap migration, csv etc) assigned licenses.
As far as I know in order they (migrated users) could work on o365 completely we have configure dns settings on domain which we selected as default EAC. If we add the records which are required, the zimbra wouldn't start work properly. But we want to keep both servers as online. What should we do in further in order both servers could send email to each other (send\receive from\to internal\external emails)
If sender (doesn't matter if he external or user zimbra) send an email to the user o365, email anyway comes to zimbra server.
Hope I could explain the situation.
Yes, I tried to add MX record of O365, and faced with the problem incoming email to old server, and noticed that o365 by default requires priority 0. The only solution is to migrate all users to O365 and add MX record. As temp solution is as you said onmicrosoft.com , I used forward from Zimbra to O365, and in case if user will send email to onmicrosft.com forward from onmicrosft,com to zimbra using Contact on exchange. And enabled external forwarding whoch is disabled by default.
Researchers have uncovered a "mass-spreading" social engineering campaign targeting Zimbra users within small and medium businesses as well as government entities. The campaign has been observed targeting entities primarily in Poland, Ecuador, and Italy, and targets users of the Zimbra Collection platform, which is an "open-core collaborative software platform" that is a common enterprise email alternative. The threat actor responsible for the campaign has yet to be attributed and the goal appears to be collecting account credentials. Campaign targets receive a phishing email with a warning about an email server update, account deactivation, or similar issue and prompts the user to open an attached HTML file containing a phishing page. The sender is spoofed to appear as an email server administrator. Once the attached file is clicked, the file is opened in the victim's browser and a fraudulent and customized Zimbra login page appears. Researchers noted that the username field in the fake login form is prefilled to appear more legitimate. If the user submits credentials, the credentials are sent to the actor-controlled command-and-control (C2) server. The campaign has been active since April 2023. Additional technical details as well as indicators of compromise (IOCs) can be viewed in the report linked below.
760c119bf3