I'll answer to my own question.
I find out that new accounts doesn't affected by the problem. Then i looked at the nginx.log and found following
This upstream 45.80.151.100:7995 looks kinda malicious. I found solution in the article below
https://wiki.zimbra.com/wiki/Blocking_Memcached_Attack
But! Memcached port is covered by firewall, i.e. does not accessible from the Internet. So how could it be affected by this exploit?
I find out that new accounts doesn't affected by the problem. Then i looked at the nginx.log and found following
Code:
root@mail | 16:16:01 :~# tail -f /opt/zimbra/log/nginx.log | grep -a -i user12024/03/06 16:16:08 [info] 3436#0: *3445820 client logged in, client: 1.1.1.1:51334, server: 2.2.2.2:995, login: "user1@domain1.com", upstream: 45.80.151.100:7995 (1.1.1.1:51334->1.1.1.1:995) <=> (1.1.1.1:3851 45.80.151.100:7995)2024/03/06 16:16:08 [info] 3436#0: *3445820 proxied session done, client: 1.1.1.1:51334, server: 1.1.1.1:995, login: "user1@domain1.com", upstream: 45.80.151.100:7995 (1.1.1.1:51334->1.1.1.1:995) <=> (1.1.1.1:3851 45.80.151.100:7995)2024/03/06 16:16:08 [crit] 3436#0: *3445820 SSL_shutdown() failed (SSL: error:14094123:SSL routines:ssl3_read_bytes:application data after close notify) while proxying, client: 1.1.1.1:51334, server: 1.1.1.1:995, login: "user1@domain1.com", upstream: 45.80.151.100:7995 (1.1.1.1:51334->1.1.1.1:995) <=> (->)^Croot@mail | 16:16:12 :~# tail -f /opt/zimbra/log/nginx.log | grep -a -i user22024/03/06 16:16:26 [info] 3438#0: *3445832 client logged in, client: 1.1.1.1:34740, server: 1.1.1.1:995, login: "user2@domain1.com", upstream: 1.1.1.1:7995 (1.1.1.1:34740->1.1.1.1:995) <=> (1.1.1.1:34110->1.1.1.1:7995)2024/03/06 16:16:26 [info] 3438#0: *3445832 proxied session done, client: 1.1.1.1:34740, server: 1.1.1.1:995, login: "user2@domain1.com", upstream: 1.1.1.1:7995 (1.1.1.1:34740->1.1.1.1:995) <=> (1.1.1.1:34110->1.1.1.1:7995)https://wiki.zimbra.com/wiki/Blocking_Memcached_Attack
But! Memcached port is covered by firewall, i.e. does not accessible from the Internet. So how could it be affected by this exploit?
Statistics: Posted by arukashi — Wed Mar 06, 2024 6:12 pm