zimbra Qualys A+

Introduction

Ensuring the security and compliance of your Zimbra email system is essential for protecting sensitive information and maintaining trust with users. Qualys, a leading provider of security assessments, offers tools to help identify and remediate vulnerabilities within your Zimbra infrastructure. 

In this article, we will explore how to use Qualys to assess and enhance the security of your Zimbra email system, providing you with a step-by-step guide to safeguard your organization's communications.

zimbra Qualys A+

How to zimbra A+ in the Qualys SSL Labs Security Test. To help system zimbra security hardening. Let's go labs. in my post,i use zimbra account ( su - zimbra) 

Zimbra without Proxy ( zimbra mailbox+zimbra ldap+zimbra MTA)

Tune the cipher list ( you to check zimbraSSLExcludeCipherSuites before run command)

zmprov mcf +zimbraSSLExcludeCipherSuites TLS_DHE_RSA_WITH_AES_128_CBC_SHA

 

zmprov mcf +zimbraSSLExcludeCipherSuites TLS_DHE_RSA_WITH_AES_128_CBC_SHA256

 

zmprov mcf +zimbraSSLExcludeCipherSuites TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

 

zmprov mcf +zimbraSSLExcludeCipherSuites SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA \
+zimbraSSLExcludeCipherSuites SSL_DHE_DSS_WITH_DES_CBC_SHA \
+zimbraSSLExcludeCipherSuites SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA \
+zimbraSSLExcludeCipherSuites SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA \
+zimbraSSLExcludeCipherSuites SSL_DHE_RSA_WITH_DES_CBC_SHA \
+zimbraSSLExcludeCipherSuites SSL_RSA_EXPORT_WITH_DES40_CBC_SHA \
+zimbraSSLExcludeCipherSuites SSL_RSA_EXPORT_WITH_RC4_40_MD5 \
+zimbraSSLExcludeCipherSuites SSL_RSA_WITH_3DES_EDE_CBC_SHA \
+zimbraSSLExcludeCipherSuites SSL_RSA_WITH_DES_CBC_SHA \
+zimbraSSLExcludeCipherSuites SSL_RSA_WITH_RC4_128_MD5 \
+zimbraSSLExcludeCipherSuites SSL_RSA_WITH_RC4_128_SHA \
+zimbraSSLExcludeCipherSuites TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA \
+zimbraSSLExcludeCipherSuites TLS_ECDHE_RSA_WITH_RC4_128_SHA \
+zimbraSSLExcludeCipherSuites TLS_RSA_EXPORT_WITH_DES40_CBC_SHA \
+zimbraSSLExcludeCipherSuites TLS_RSA_WITH_3DES_EDE_CBC_SHA \
+zimbraSSLExcludeCipherSuites TLS_RSA_WITH_AES_128_CBC_SHA \
+zimbraSSLExcludeCipherSuites TLS_RSA_WITH_AES_128_CBC_SHA256 \
+zimbraSSLExcludeCipherSuites TLS_RSA_WITH_AES_128_GCM_SHA256 \
+zimbraSSLExcludeCipherSuites TLS_RSA_WITH_DES_CBC_SHA

Restart the mailbox service

zmmailboxdctl restart

To configure Strict Transport Security (HSTS)

vim /opt/zimbra/jetty/etc/jetty.xml.in

Add the following

<Call name="addRule">
           <Arg>
              <New class="org.eclipse.jetty.rewrite.handler.HeaderPatternRule">
                 <Set name="pattern">*</Set>
                 <Set name="name">Strict-Transport-Security</Set>
                 <Set name="value">max-age=15768000; includeSubDomains</Set>
              </New>
           </Arg>
        </Call>

Zimbra using Proxy (zimbra mailbox+zimbra proxy+zimbra MTA+zimbra ldap)

To create a new 2048 key

openssl dhparam -out /opt/zimbra/conf/dhparam.pem 2048

Edit the following two files

/opt/zimbra/conf/nginx/templates/nginx.conf.web.https.default.template
/opt/zimbra/conf/nginx/templates/nginx.conf.web.https.template

Add a ssl_dhparam entry before the include

ssl_verify_client ${ssl.clientcertmode.default};
ssl_verify_depth ${ssl.clientcertdepth.default};
ssl_dhparam /opt/zimbra/conf/dhparam.pem;
include                 ${core.includes}/${core.cprefix}.web.https.mode-${web.mailmode};

Tune the cipher list

zmprov mcf zimbraReverseProxySSLCiphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4'

Restart the proxy

zmproxyctl restart

To configure Strict Transport Security (HSTS)
Edit files

vim /opt/zimbra/conf/nginx/templates/nginx.conf.web.https.default.template
vim /opt/zimbra/conf/nginx/templates/nginx.conf.web.https.template

add the following in the server { ... } section:

add_header Strict-Transport-Security "max-age=31536000";
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 5m;

To restart the proxy

zmproxyctl restart

Test zimbra Qualys A+ online
https://www.ssllabs.com/ssltest/analyze.html

Conclusion

Using Qualys to assess the security of your Zimbra email system is a proactive approach to identifying and addressing potential vulnerabilities. By following the steps outlined in this guide, you can enhance the security of your email infrastructure, ensuring compliance and protecting sensitive data. We hope this article has been informative and encourage you to explore our website for more tips and best practices in managing your Zimbra email system. thank you for reading the huuphan.com page!