Security Settings for Zimbra Collaboration 8.8 series
Important: Upgrading from Older ZCS Versions
Defaults may change from version to version of ZCS. However, when upgrading some settings may not be updated to the new recommended default: possibly because the settings had been customized, installer limitations/bugs, or concerns that changes may impact existing users/clients. As such, it is highly recommended that you revisit settings after upgrading to ensure that values are set as expected/desired in your environment and security settings meet your requirements.
Depending upon the version you are upgrading from, you should (re)visit the security related recommendations and changes noted in earlier versions of this document (Security/Collab, Security/Collab/86, Security/Collab/87).
Recommended HTTP Headers
It is recommended to set most, if not all of the following HTTP headers for most ZCS deployments. Take a little time to determine what makes the most sense in your deployment.
HTTP Strict-Transport-Security (HSTS) enforces secure (HTTP over SSL/TLS) connections to the server.
zmprov mcf +zimbraResponseHeader "Strict-Transport-Security: max-age=31536000" OR zmprov mcf +zimbraResponseHeader "Strict-Transport-Security: max-age=31536000; includeSubDomains"
Enables the Cross-site scripting (XSS) filter built into most recent web browsers:
zmprov mcf +zimbraResponseHeader "X-XSS-Protection: 1; mode=block"
Prevent Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type.
zmprov mcf +zimbraResponseHeader "X-Content-Type-Options: nosniff"
ZCS does not contain a default Content-Security-Policy header (bug 58216). However, it is recommended to create one that meets the requirements of your site.
- https://www.youtube.com/watch?v=L97wtYCqfwM - Understanding CSP
- http://cspisawesome.com/ - online Content-Security-Policy generator
- http://caniuse.com/#search=ContentSecurityPolicy - check browser support