Zimbra Mail Server automatically quarantines emails that get hit by the Antivirus scan using Clam when the mail is received. While putting the email on the recipient inbox, what it does, instead of giving the original email with the attachment, it sends a virus detected email with the following kind of error message:
Virus (Heuristics.Encrypted.PDF) in mail to YOU
by Zimbra
Virus Alert
Our content checker found
virus: Heuristics.Encrypted.PDF
It actually means, the original mail is now quarantined. Zimbra maintains a virus quarantine email account that is not normally available in the ‘Manage Account’ list of Zimbra Admin panel. You can find it if you search with ‘virus’ in the ‘Search’ box of the admin panel. What zimbra does in quarantine situation, is that, it pushes the mail to the quarantine email instead of original recipient.
Now, to get back the mail delivered to the original recipient, we need to first get the quarantine email account, get the message id, and then we need to inject the mail into the LMTP pipe that bypasses any scanning. Here are the steps on how to do this:
# First get to the zimbra user $ su - zimbra # Get the email account that is used to store virus detected mails $ zmprov gcf zimbraAmavisQuarantineAccount zimbraAmavisQuarantineAccount: [email protected] # [email protected] this should be our quarantine email account, now we need to get the quarantine account's mailbox id $ zmprov gmi [email protected] mailboxId: 73 quotaUsed: 644183 # Mailbox id here for the quarantine account is 73. Now go to the message storage of this id using the following command: cd /opt/zimbra/store/0/<mailboxId>/msg/0 $ cd /opt/zimbra/store/0/73/msg/0 # list the messages $ ls *
These are your quarantined emails. Now for example the complainer is ‘[email protected]’. To search for the emails designated for this email account, you may use the following:
$ grep -l [email protected] * 281-1216.msg 300-1400.msg 301-1476.msg
This should return you all the emails that got quarantined for the above user.
Now the question is, how can we get these emails delivered to the designated user bypassing the antivirus/antispam tools. To do this, you need to inject the mail into LMTP pipe. You may do this using ‘zmlmtpinject’ command as following:
$ zmlmtpinject -r [email protected] -s [email protected] 281-1216.msg
Remember, to change [email protected] to the original recipient. [email protected] would be the newly rewritten sender for this mail delivery and ‘281-1216.msg’ is the file name of the original email that you found out from the grep command. You can do lmtp injections for one email mail with each command. So, you would require to do this for each emails.