WAF and server protection setup

The request firewall and the server integrity monitor come in one installation step; afterwards the mail service restarts once and a baseline is recorded.

Select the waf module in the installer. It:

• installs the WAF and zimbra-guard scripts under /opt/zimbra/libexec,
• creates the rule files from samples (existing ones are left alone),
• lets the zimbra user run only zimbra-guard with fixed commands,
• schedules an hourly integrity check,
• attaches the filters to the proxy and mail server layers.

After installation

1. Restart mailboxd: su - zimbra -c 'zmmailboxdctl restart'
2. Check: su - zimbra -c 'zimbra-guard-waf check' → closed paths must return 403.
3. Make sure the system is clean (zimbra-guard audit), then record the baseline: zimbra-guard baseline.
4. Set the notification address (MAILTO) in /etc/zimbra-guard.conf.
5. In the admin console open Tools and Migration › Profelis WAF; the Proxy, Filter and Guard layer badges should all be green.

Profelis WAF: the three layer badges

After a Zimbra upgrade

A Zimbra upgrade renews the proxy templates and web application settings. After upgrading, run zimbra-guard-waf apply and restart mailboxd.

Maintenance mode

Before installing files on the server, run zimbra-guard maintenance on; when done, off and, if needed, baseline. Otherwise the hourly check may quarantine the new file.

Permissions file

Do not extend /etc/sudoers.d/zimbra-guard; every command in it runs as root.