<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>Hello Jim,</div><div><br data-mce-bogus="1"></div><div>Thank you for your reply.</div><div><br></div><div>Zimbra support has sent us a change to be applied in the Nginx configuration and it solved the issue with the "OIP". It's displaying now only the client IP.</div><div><br data-mce-bogus="1"></div><div>We hope this solves an issue we are facing that causes a high CPU load (100% sometimes) on all our servers.</div><div><br data-mce-bogus="1"></div><div>These are the commands I have used to fix the OIP:</div><div><br data-mce-bogus="1"></div><div> <!--StartFragment--><div style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #fbfbfc; text-decoration-style: initial; text-decoration-color: initial;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #fbfbfc; text-decoration-style: initial; text-decoration-color: initial;">cd /opt/zimbra/conf/nginx/templates</div><div style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #fbfbfc; text-decoration-style: initial; text-decoration-color: initial;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #fbfbfc; text-decoration-style: initial; text-decoration-color: initial;"><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;"><div>sed -i 's/$proxy_add_x_forwarded_for/$http_x_forwarded_for/g' *</div><div>zmproxyctl restart</div></div></div><!--EndFragment--> </div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div data-marker="__SIG_PRE__"><div><b><span style="color: #06447c; font-family: Verdana; font-size: small;">Atenciosamente,</span></b></div><div><b><span style="color: #06447c; font-family: Verdana; font-size: small;">Fabio S. Schmidt</span></b><p style="margin: 3px;"><span style="color: #808080; font-size: 10pt;"><strong><span style="font-family: Verdana,sans-serif;">Diretor técnico</span></strong></span></p><p style="margin: 3px; color: #808080; font-size: 10pt;">E-mail: fabio@bktech.com.br<br>www.bktech.com.br<br>Tel.: +55 (61) 3226-7932</p><p style="margin: 3px; color: #808080; font-size: 10pt;">Cel.: +55 (61) 99116-3941</p></div></div><div><br></div><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>De: </b>"Jim Dunphy" <jad@aesir.com><br><b>Para: </b>"Fabio Schmidt" <fabio@bktech.com.br><br><b>Cc: </b>"Brando Beaumont" <branzo@itaserv.net>, "users" <users@lists.zetalliance.org><br><b>Enviadas: </b>Segunda-feira, 27 de maio de 2019 13:15:57<br><b>Assunto: </b>Re: [Users] Did anyone have any issue with some balancer in front of Zimbra?<br></div><div><br></div><div data-marker="__QUOTED_TEXT__"><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>If you need something faster,<br></div><br><div>I followed this link's advice ... using the set_real_ip_from, real_ip_recursive on and real_ip_header X-Forwarded-For.<br></div><br><div>Explained in detail here:<br></div><br><div>https://serverfault.com/questions/314574/nginx-real-ip-header-and-x-forwarded-for-seems-wrong<br><br></div><div>I tested various spoofing chaining scenarios and it appeared to do the correct thing. I don't use this with zimbra however only our web farms.<br></div><br><div>From my perspective, this is a security bug at least in the 8.7.11+ branch and not a RFE given how trivial it is to spoof a client side header that allows an attacker to hide in the logs.<br></div><br><div>w/r<br></div><br><div>Jim<br></div><br><br><span id="zwchr">----- On May 27, 2019, at 8:50 AM, Fabio S. Schmidt <fabio@bktech.com.br> wrote:<br></span><div><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><div id="zimbraEditorContainer" style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000" class="82"><div>Greetings Brando,</div><br><div>Thank you for your reply. I've submitted to Zimbra an RFE to support the origin IP with this format.</div><br><div>Best regards.</div><br><div><div><b><span style="color: #06447c; font-family: Verdana; font-size: small;">Atenciosamente,</span></b></div><div><b><span style="color: #06447c; font-family: Verdana; font-size: small;">Fabio S. Schmidt</span></b><p style="margin: 3px;"><span style="color: #808080; font-size: 10pt;"><strong><span style="font-family: Verdana,sans-serif;">Diretor técnico</span></strong></span></p><p style="margin: 3px; color: #808080; font-size: 10pt;">E-mail: fabio@bktech.com.br<br>www.bktech.com.br<br>Tel.: +55 (61) 3226-7932</p><p style="margin: 3px; color: #808080; font-size: 10pt;">Cel.: +55 (61) 99116-3941</p></div></div><br><hr id="zwchr"><div><b>De: </b>"Brando Beaumont" <branzo@itaserv.net><br><b>Para: </b>"Fabio Schmidt" <fabio@bktech.com.br><br><b>Cc: </b>"users" <users@lists.zetalliance.org><br><b>Enviadas: </b>Segunda-feira, 27 de maio de 2019 5:28:54<br><b>Assunto: </b>Re: [Users] Did anyone have any issue with some balancer in front of Zimbra?<br></div><br><div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>Good morning Fabio,</div><br><div>as stated here [1], X-Forwaded-For can pass multiple IPs. Including the IP of the Netscaler should add another IP to the list.. </div><br><div>cya,</div><div>Brando B.</div><br><div>[1] - <a href="https://en.wikipedia.org/wiki/X-Forwarded-For" target="_blank">https://en.wikipedia.org/wiki/X-Forwarded-For</a><br></div><br><hr id="zwchr"><div><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>Da: </b>"Fabio S. Schmidt" <fabio@bktech.com.br><br><b>A: </b>"users" <users@lists.zetalliance.org><br><b>Inviato: </b>Venerdì, 24 maggio 2019 15:25:13<br><b>Oggetto: </b>[Users] Did anyone have any issue with some balancer in front of Zimbra?<br></blockquote></div><div><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>Hello guys,</div><br><div>Our customers always use a balancer in front of Zimbra to balance the load and implement H.A. at least for the proxy servers. </div><br><div>A particular customer use Netscaler and we have noticed that it is displaying both the IPs (client and the balancer) on our logs:</div><br><div>;mid=231<strong>;oip=10.32.90.33, 172.16.5.1</strong><br></div><div><strong><br></strong></div><div>These logs are being displayed on zmmailboxd.out:</div><br><div>Ignoring malformed remote address 10.32.90.33, 172.16.5.1<br></div><br><div>Maybe should we include the Netscaler IP on the Zimbra trusted IP parameter?</div><br><div>Best regards.</div><div>Fabio S. Schmidt</div></div></blockquote></div></div></div></div></blockquote></div></div><br></div></div></body></html>