Skip to main content

Connection problems

If the web admin UI does not open at http://<host>:7081 (or https://<host>:7081), work through the steps below to identify and resolve the issue.

1. Verify the web service is running​

systemctl status msh-zr-web.service

The Active: line must show active (running). If the service is not running, see Services to find out why, and restart it:

sudo systemctl restart msh-zr-web.service

2. Verify the port is listening​

Check that the web application is actually listening on its port (default 7081):

sudo ss -tlnp | grep 7081

If nothing is listening, the service is still starting up or failed - watch the startup in the journal:

journalctl -u msh-zr-web.service -f

If you changed WEB_PORT in etc/config.cf, use that port in the browser and in the checks above.

3. Check the firewall​

If the UI works from the server itself (curl -k https://localhost:7081 or curl http://localhost:7081) but not from your workstation, a firewall is blocking the port. Allow it, e.g. with ufw:

sudo ufw allow 7081/tcp
note

Expose the web UI only to networks administrators connect from. The milter port 7080 never needs to be reachable from anywhere except the Zimbra MTA (usually the same host).

4. HTTP vs HTTPS mismatch​

The web UI serves either plain HTTP or HTTPS on the same port, depending on whether a keystore is configured:

  • If HTTPS is enabled and you open http://<host>:7081, the browser receives a TLS response on a plain connection and shows an error - use https://.
  • If HTTPS is not enabled and you open https://<host>:7081, the TLS handshake fails - use http://.
  • If you configured a keystore but the UI still answers on HTTP, the keystore file is probably missing. The launcher then logs a warning and falls back to HTTP - check the journal for:
WEB_SSL_KEYSTORE is set to '<path>' but no such file exists; starting on HTTP.

See Server installation for the HTTPS setup.

5. Self-signed certificate warning​

If you generated the keystore with gen-cert, the certificate is self-signed and every browser warns about it until the certificate is trusted. This is expected for an internal admin UI - proceed past the warning, or install a CA-issued certificate instead.

6. Login fails​

If the UI loads but you cannot log in, the initial credentials are admin / admin (change them after the first login on the Access Control page). If the password was changed and lost, see Reset credentials.