zimbra Qualys A+

-
How to zimbra A+ in the Qualys SSL Labs Security Test. To help system zimbra security hardening. Let's go labs. in my post,i use zimbra account ( su - zimbra) 
zimbra Qualys A+







Zimbra without Proxy ( zimbra mailbox+zimbra ldap+zimbra MTA)

Tune the cipher list ( you to check zimbraSSLExcludeCipherSuites before run command)
zmprov mcf +zimbraSSLExcludeCipherSuites TLS_DHE_RSA_WITH_AES_128_CBC_SHA
zmprov mcf +zimbraSSLExcludeCipherSuites TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
zmprov mcf +zimbraSSLExcludeCipherSuites TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
zmprov mcf +zimbraSSLExcludeCipherSuites SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA \
+zimbraSSLExcludeCipherSuites SSL_DHE_DSS_WITH_DES_CBC_SHA \
+zimbraSSLExcludeCipherSuites SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA \
+zimbraSSLExcludeCipherSuites SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA \
+zimbraSSLExcludeCipherSuites SSL_DHE_RSA_WITH_DES_CBC_SHA \
+zimbraSSLExcludeCipherSuites SSL_RSA_EXPORT_WITH_DES40_CBC_SHA \
+zimbraSSLExcludeCipherSuites SSL_RSA_EXPORT_WITH_RC4_40_MD5 \
+zimbraSSLExcludeCipherSuites SSL_RSA_WITH_3DES_EDE_CBC_SHA \
+zimbraSSLExcludeCipherSuites SSL_RSA_WITH_DES_CBC_SHA \
+zimbraSSLExcludeCipherSuites SSL_RSA_WITH_RC4_128_MD5 \
+zimbraSSLExcludeCipherSuites SSL_RSA_WITH_RC4_128_SHA \
+zimbraSSLExcludeCipherSuites TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA \
+zimbraSSLExcludeCipherSuites TLS_ECDHE_RSA_WITH_RC4_128_SHA \
+zimbraSSLExcludeCipherSuites TLS_RSA_EXPORT_WITH_DES40_CBC_SHA \
+zimbraSSLExcludeCipherSuites TLS_RSA_WITH_3DES_EDE_CBC_SHA \
+zimbraSSLExcludeCipherSuites TLS_RSA_WITH_AES_128_CBC_SHA \
+zimbraSSLExcludeCipherSuites TLS_RSA_WITH_AES_128_CBC_SHA256 \
+zimbraSSLExcludeCipherSuites TLS_RSA_WITH_AES_128_GCM_SHA256 \
+zimbraSSLExcludeCipherSuites TLS_RSA_WITH_DES_CBC_SHA
Restart the mailbox service
zmmailboxdctl restart
To configure Strict Transport Security (HSTS)
vim /opt/zimbra/jetty/etc/jetty.xml.in
Add the following
<Call name="addRule">
           <Arg>
              <New class="org.eclipse.jetty.rewrite.handler.HeaderPatternRule">
                 <Set name="pattern">*</Set>
                 <Set name="name">Strict-Transport-Security</Set>
                 <Set name="value">max-age=15768000; includeSubDomains</Set>
              </New>
           </Arg>
        </Call>

Zimbra using Proxy (zimbra mailbox+zimbra proxy+zimbra MTA+zimbra ldap)

To create a new 2048 key
openssl dhparam -out /opt/zimbra/conf/dhparam.pem 2048
Edit the following two files
/opt/zimbra/conf/nginx/templates/nginx.conf.web.https.default.template
/opt/zimbra/conf/nginx/templates/nginx.conf.web.https.template
Add a ssl_dhparam entry before the include
ssl_verify_client ${ssl.clientcertmode.default};
ssl_verify_depth ${ssl.clientcertdepth.default};
ssl_dhparam /opt/zimbra/conf/dhparam.pem;
include                 ${core.includes}/${core.cprefix}.web.https.mode-${web.mailmode};
Tune the cipher list
zmprov mcf zimbraReverseProxySSLCiphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4'
Restart the proxy
zmproxyctl restart
To configure Strict Transport Security (HSTS)
Edit files
vim /opt/zimbra/conf/nginx/templates/nginx.conf.web.https.default.template
vim /opt/zimbra/conf/nginx/templates/nginx.conf.web.https.template
add the following in the server { ... } section:
add_header Strict-Transport-Security "max-age=31536000";
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 5m;
To restart the proxy
zmproxyctl restart
Test zimbra Qualys A+ online
https://www.ssllabs.com/ssltest/analyze.html

Comments

Post a Comment

Popular posts from this blog

zimbra some services are not running [Solve problem]

-
Image
How to solved zimbra some services are not running. That after, to installed zimbra mail server. The display a some admin console status red in environment multiple server ( zimbra ldap, zimbra mailbox, zimbra mta etc.). Link to below you maybe likes: How to install and configure zimbra multi server.   How to restrict to user sending mail on zimbra 8.6. How to Restrict Sending to Distribution list in zimbra mail. How to change last login time for all accounts in zimbra ldap. How to zimbra reject authenticated sender login mismatch. Error zimbra some services are not running as bellow Step by step guide the solve problem zimbra some services are not running the following: To restart and enable cron service the permanently. service crond restart chkconfig crond on Opening rsyslog.conf file and uncomment the following. vim /etc/rsyslog.conf Uncomment these two lines $modload imupd $UDPServerRun514   To restart and enable rsyslog service the permanently. servic
Read more

How to install and configure zimbra multi server

-
Image
In small system, to install zimbra All-in-one in single server mail .In medium and large system zimbra mail server, to install and configure multi server (the more ldap, mta , mailbox install in server separate). in this my post, the tutorial install and configure zimbra multi server and   use demo zimbra 8.6  Let's go! My Lab: Zimbra ldap Hostname: ldap.huuphan.local ip address: 192.168.131.11 Zimbra MTA Hostname: mta.huuphan.local ip address: 192.168.131.12 Zimbra Mailbox Hostname: mailbox.huuphan.local ip address: 192.168.131.13 Zimbra Proxy Hostname: proxy.huuphan.local ip address: 192.168.131.14 The requirement zimbra mail server *The DNS  mx records point to zimbra mail server to recive mail from internet. A records to resolve hostnames. *Firewall allow to ports of zimbra or disable firewall the example use to iptable. *Note: In this my post, using dns bind the external server for zimbra mail server.  How To Install the BIND DNS Ser
Read more

Bash script list all IP addresses connected to Server

-
Image
Running to bash script list all IP addresses connected to Server ./studyscript.sh  >/dev/null 2>&1 The bash script list all IP addresses connected to Server #!/bin/bash rm -f /tmp/list_IP rm -f /tmp/list_IPP rm -f /tmp/list_IPdone netstat -ntu | grep ESTA | awk -F: '{ print $2 }' | sed -r 's/^.{12}//' |sed 's/:/\n/g' | sed '/^\s*$/d'| sort > /tmp/list_IP #sleep 10 while read -r p do  curl ipinfo.io/$p done < /tmp/list_IP >/tmp/list_IPP cat /tmp/list_IPP | egrep "ip|country" |sed '$!N;s/\n/ /' |sed -r 's/^.{9}//' |sed 's/"country": "//' |sed 's/",//g' >> /tmp/list_IPdone echo "-----IP------  --country--" >> /tmp/list_IPdone Note the bash script list all IP addresses connected to Server sed 's/:/\n/g' Delete duplicate lines sed '/^\s*$/d' Delete empty lines sed '$!N;s/\n/ /' How to merge every two lines in
Read more