Security/Collab/88: Difference between revisions

(- added mention of settings to avoid mailsploit)
No edit summary
 
Line 18: Line 18:


Ref: https://www.owasp.org/index.php/List_of_useful_HTTP_headers
Ref: https://www.owasp.org/index.php/List_of_useful_HTTP_headers
See: https://wiki.zimbra.com/wiki/Secopstips


=== Strict-Transport-Security (HSTS) ===
=== Strict-Transport-Security (HSTS) ===
HTTP Strict-Transport-Security (HSTS) enforces secure (HTTP over SSL/TLS) connections to the server.
  zmprov mcf +zimbraResponseHeader "Strict-Transport-Security: max-age=31536000"
OR
  zmprov mcf +zimbraResponseHeader "Strict-Transport-Security: max-age=31536000; includeSubDomains"


=== X-XSS-Protection ===
See: https://wiki.zimbra.com/wiki/Cipher_suites
Enables the Cross-site scripting (XSS) filter built into most recent web browsers:


  zmprov mcf +zimbraResponseHeader "X-XSS-Protection: 1; mode=block"


=== X-Content-Type-Options ===
=== X-Content-Type-Options ===

Latest revision as of 06:01, 27 July 2022

  1. Zimbra Tech Center
  2. Certified
  3. Security/Collab/88

Security Settings for Zimbra Collaboration 8.8 series

   KB 23652        Last updated on 2022-07-27  




0.00
(0 votes)


Important: Upgrading from Older ZCS Versions

Defaults may change from version to version of ZCS. However, when upgrading some settings may not be updated to the new recommended default: possibly because the settings had been customized, installer limitations/bugs, or concerns that changes may impact existing users/clients. As such, it is highly recommended that you revisit settings after upgrading to ensure that values are set as expected/desired in your environment and security settings meet your requirements.

Depending upon the version you are upgrading from, you should (re)visit the security related recommendations and changes noted in earlier versions of this document (Security/Collab, Security/Collab/86, Security/Collab/87).

Neutralizing Mailsploit

As mentioned in the Security Center, to avoid Mailsploit it is recommend that all sites upgrading to manually set zimbraPrefShortEmailAddress to FALSE. This is the default for new 8.8.7 installs.

Recommended HTTP Headers

It is recommended to set most, if not all of the following HTTP headers for most ZCS deployments. Take a little time to determine what makes the most sense in your deployment.

Ref: https://www.owasp.org/index.php/List_of_useful_HTTP_headers

See: https://wiki.zimbra.com/wiki/Secopstips

Strict-Transport-Security (HSTS)

See: https://wiki.zimbra.com/wiki/Cipher_suites


X-Content-Type-Options

Prevent Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type. 

zmprov mcf +zimbraResponseHeader "X-Content-Type-Options: nosniff"

Content-Security-Policy

ZCS does not contain a default Content-Security-Policy header (bug 58216). However, it is recommended to create one that meets the requirements of your site.

Useful references:

Verified Against: Zimbra Collaboration 8.8 Date Created: 02/08/2018
Article ID: https://wiki.zimbra.com/index.php?title=Security/Collab/88 Date Modified: 2022-07-27



Try Zimbra

Try Zimbra Collaboration with a 60-day free trial.
Get it now »

Want to get involved?

You can contribute in the Community, Wiki, Code, or development of Zimlets.
Find out more. »

Other help Resources

User Help Page »
Official Forums »
Zimbra Documentation Page »

Looking for a Video?

Visit our YouTube channel to get the latest webinars, technology news, product overviews, and so much more.
Go to the YouTube channel »

Retrieved from "http://wiki.zimbra.com/index.php?title=Security/Collab/88&oldid=69117"
Jump to: navigation, search