Zimbra Virus Quarantine
How to push a message through that triggered a false-positive on Zimbra's Virus detection
Our Zimbra email service is a great alternative to Microsoft Exchange, one of its built-in features being spam/virus protection.
One thing it currently lacks though is a full "quarantine" system, which is rarely a problem, but very occasionally a false positive is triggered by an attempt at sending a file securely falling foul of the "block encrypted archives" option. At this time it's handy to be able to send the mail on its way.
I had to do this today, and here's what I did:
- Find the right mail in /opt/zimbra/data/amavisd/quarantine it will be called something like virus-1BghBzSYKd2E - this can involve finding the time of the original message in the logs and comparing with the timestamp on the virus file. In the unix world "ls -lhrt" is your friend here for listing the virus files in order of arrival. The location could be different on your install.
- Deselect the option to block enrypted archives in Global Settings -> AS/AV (or remove filtering of the particular file type also in the Global Settings as appropriate).
- On the server as user zimbra do "zmamavisdctl restart"
- To send the mail on its way again: sendmail -t -i < virus-1BghBzSYKd2E
- Look in /var/log/mail.log for the mail being sent ok and not still being rejected.
- Reselect the block encrypted archives option so that it operates in future
- On the server as user zimbra do "zmamavisdctl restart" to finally put things back to normal.
Email is a great tool but encrypted zip files are quite weak from a security perspective, so probably a better means of communication for a private file like this is to send by a secure means such as Dropbox or, if sending from Zimbra, to use the Zimbra Briefcase, or to use a more robust form of encryption for the email such as PGP.
Encrypted ZIP is better than nothing OR dropbox
I respectfully disagree that encrypted ZIP files aren't secure. The limitation on ZIP encryption security is how secure the passphrase used is, not some flaw in the implementation. Brute force ZIP encryption crackers have been around for 20 yrs, but the actual encryption used is solid. Use a 40+ character, random, passphase and don't worry about it.
OTOH, Dropbox has been found to have a less-that-great implementation where files could be seen by others - sometimes random other people.
I do agree that gpg would be better, but very few people will go to the effort to setup a personal key, get it signed, and Zimbra doesn't have built-in support for GPG, so a 3rd party client like Thunderbird + Enigmail extension is needed to make this useful.
Now you have the same issue with poor passphrases to access GPG keys.
I **wish** I could get our accountant and lawyer to use GPG, but it is simply too hard for them, so we're suck using ZIP files with passphrases (which they hate too).
Anyway, if encrypted email were easy, it would already be solved for everyone in a workable way. "Convenience" is often the enemy of "secure."