Re: LDAP Change Log

[Keith McDermott <kmcdermo@purdue.edu>]

Hi Will,

We do this by looking at several preferences of each account to look for 
spammy items.

I'd suggest taking a look at the following items through zmprov:

ga -e <account> uid zimbraPrefMailForwardingAddress 
zimbraPrefMailLocalDeliveryDisabled zimbraPrefSaveToSent
gsig <account> zimbraSignatureName zimbraPrefMailSignature 
zimbraPrefMailSignatureHTML
gid <account> zimbraPrefIdentityName zimbraPrefFromDisplay 
zimbraPrefFromAddress zimbraPrefReplyToDisplay zimbraPrefReplyToAddress

We are doing this on 6.0.10 but we will be moving to Zimbra 8 relatively 
soon.

Thanks,
Keith

Keith McDermott
Messaging Systems Administrator – ITIS, ITaP
Purdue University

E-mail: keithmcd@purdue.edu
Address:401 S. Grant Street
        West Lafayette, IN 47907

On 5/26/13 12:09 AM, William Froning wrote:
> Hello All,
>
> I was wondering how you all are monitoring Zimbra LDAP change events. I can't seem to find the right log (if it is even enabled) to watch for account changes that might suggest a compromised account.
>
> We are running 7.2.1. Any assistance is welcome.
>
> Thanks,
> Will