Configuring the decompression engine filters

Check password protected archives

Screenshot 68 - Configuring password protected archives options

This filter allows you to quarantine or delete emails that contain password-protected archives. To configure this filter:

1. Click the GFI MailSecurity > Decompression node.

2. From the list of available filters (in the right window), click on Check password protected archives.

3. Select the Check password protected archives check box to enable this filter.

4. Specify what to do with emails containing password-protected archives by selecting one of the following options:

•	Quarantine – Select this option to quarantine the emails that contain a password-protected archive. The administrator can later review these quarantined emails and approve or delete them accordingly.

•	Automatically Delete – Select this option to delete emails containing password-protected archives.

5. Click the Actions tab to configure any actions to be performed whenever an email containing a password-protected archive is detected and blocked. For more information on how to configure actions refer to the ‘Configuring decompression filter actions’ section in this chapter.

6. Click Apply.

Check corrupted archives

This filter allows you to quarantine or delete emails that contain corrupted archives. The configuration options of this filter are identical to those of the ‘Check password protected archives’. For more information on how to configure these options, refer to the ‘Check password protected archives’ section above.

Check for recursive archives

Screenshot 69 - Configuring recursive archives options

This filter allows you to quarantine or delete emails that contain recursive archives. Recursive archives, also known as nested archives, are archives that contain other/multiple levels of sub-archives (i.e. archives within archives). A high number of archive levels can indicate a malicious archive: Recursive archives can be used in a DoS (Denial of Service) attack, since most content scanning and anti-virus packages crash while attempting to scan nested archive levels.

To configure this filter:

1. Click the GFI MailSecurity > Decompression node.

2. From the list of available filters (in the right window), click on Check for recursive archives.

3. Select the Check for recursive archives check box to enable this filter and specify the maximum number of nested archives permitted.

IMPORTANT: If you disable the Check for recursive archives rule, GFI MailSecurity will not scan or quarantine recursive archives, thus bypassing the anti-virus checking.

4. Decide on what to do with emails containing nested archives that exceed the specified limit by selecting one of the following options:

•	Quarantine – Select this option to quarantine the emails that contain recursive archives. The administrator can later review these quarantined emails and approve or delete them accordingly.

•	Automatically Delete – Select this option to delete emails containing recursive archives that exceed the specified nesting limit.

5. Click the Actions tab to configure any actions to be performed whenever an email containing a recursive archive is detected and blocked. For more information on how to configure actions refer to the ‘Configuring decompression filter actions’ section in this chapter.

6. Click Apply.

Check size of uncompressed files in archives

Screenshot 70 - Configuring checks for the size of uncompressed files in archives

This filter allows you to block or delete emails with archives that exceed the specified physical size when uncompressed. Hackers sometimes use this method in a DoS (Denial of Service) attack: By sending an archive that can be uncompressed to a very large file, they can often crash content security or anti-virus software.

To configure this filter:

1. Click the GFI MailSecurity > Decompression node.

2. From the list of available filters (in the right window), click on Check size of uncompressed files in archives.

3. Select the Check size of uncompressed files in archives check box to enable this feature and specify the maximum size (in MB) allowed for uncompressed files, received within an archive.

IMPORTANT: If you disable the Check size of uncompressed files in archives rule, GFI MailSecurity will not scan or quarantine archive attachments, thus bypassing the anti-virus checking.

4. Decide on what to do with emails containing archived files that exceed the specified size when un-compressed.

•	Quarantine – Select this option to quarantine the emails that contain these archives. The administrator can later review these quarantined emails and approve or delete them accordingly.

•	Automatically Delete – Select this option to delete emails containing archived files that when un-compressed, exceed the specified size limit.

5. Click the Actions tab to configure any actions to be performed whenever this filter detects and blocks emails containing an archive. For more information on how to configure actions refer to the ‘Configuring decompression filter actions’ section in this chapter.

6. Click Apply.

Check for amount of files in archives

Screenshot 71 - Configuring the amount of files in archive check

This filter allows you to quarantine or delete emails that contain an excessive amount of compressed files within an attached archive. You can specify the number of files allowed in archive attachments from the configuration options included in this filter.

To configure this filter:

1. Click the GFI MailSecurity > Decompression node.

2. From the list of filters (in the right window), click on Check for amount of files in archives.

3. Select the Check for amount of files in archives check box to enable this filter and specify the maximum amount of files allowed in an archive.

IMPORTANT: If you disable the Check for amount of files in archives rule, GFI MailSecurity will not scan or quarantine archive attachments, thus bypassing the anti-virus checking.

4. Decide on what to do with emails containing archives that exceed the specified limit of contained files by selecting one of the following options:

•	Quarantine – Select this option to quarantine the emails that contain these archives. The administrator can later review these quarantined emails and approve or delete them accordingly.

•	Automatically Delete – Select this option to delete emails containing archived files that when uncompressed contain more files than the limit specified.

5. Click the Actions tab to configure any actions to be performed whenever this filter detects and blocks emails containing an archive. For more information on how to configure actions refer to the ‘Configuring decompression filter actions’ section in this chapter.

6. Click Apply.

Scan within archives

Through the Scan within archives option, you can disable Attachment Checking and Content Checking of files in archives.

Configure this option as follows:

1. Click the GFI MailSecurity > Decompression node.

2. From the list of filters (in the right window), click on Scan within archives.

3. Select the Scan within archives check box to scan any archive attachments present in an email using the decompression and attachment scanning rules.