13.4 Email scanning
Prev | Chapter 13 Antivirus control | Next

## 13.4 Email scanning

SMTP and POP3 protocols scanning settings are defined through this tab. If scanning is enabled for at least one of these protocols, all attachments of transmitted messages are scanned.

Individual attachments of transmitted messages are saved in a temporary directory on the local disk. When downloaded completely, the files are scanned for viruses. If no virus is found, the attachment is added to the message again. If a virus is detected, the attachment is replaced by a notice informing about the virus found.

Note: Warning messages can also be sent to specified email addresses (e.g. to network administrators) when a virus is detected. For details, refer to chapter 19.4 Alerts.

### Warning

1. Antivirus control within WinRoute can only detect and block infected attachments. Attached files cannot be healed by this control!

2. Within antivirus scanning, it is possible to remove only infected attachments, entire email messages cannot be dropped. This is caused by the fact that the firewall cannot handle email messages like mailservers do. It only maintains network traffic coming through. In most cases, removal of an entire message would lead to a failure in communication with the server and the client might attempt to send/download the message once again. Thus, one infected message might block sending/reception of any other (legitimate) mail.

3. In case of SMTP protocol, only incoming traffic is checked (i.e. traffic from the Internet to the local network — incoming email at the local SMTP server). Checks of outgoing SMTP traffic (i.e. from the local network to the Internet) might cause problems with temporarily undeliverable email (for example in cases where the destination SMTP server uses so called greylisting).

   To check also outgoing traffic (e.g. when local clients connect to an SMTP server without the local network), define a corresponding traffic rule using the SMTP protocol inspector. For details, see chapter 13.2 How to choose and setup antiviruses.

Advanced parameters and actions that will be taken when a virus is detected can be set in the Email scanning tab.

Figure 13.9. Settings for SMTP and POP3 scanning

In the Specify an action which will be taken with attachments... section, the following actions can be set for messages considered by the antivirus as infected:

- Move message to quarantine — untrustworthy messages will be moved to a special directory on the WinRoute host. The WinRoute administrator can try to heal infected files and later send them to their original addressees.

  The `quarantine` subdirectory under the WinRoute directory is used for the quarantine

  (the typical path is `C:\Program Files\Kerio\WinRoute Firewall\quarantine`) Messages with untrustworthy attachments are saved to this directory under names which are generated automatically by WinRoute. Each filename includes information about protocol, date, time and the connection number used for transmission of the message.

- Prepend subject message with text — use this option to specify a text to be attached before the subject of each email message where at least one infected attachment is found. This text informs the recipient of the message and it can be also used for automatic message filtering.

Note: Regardless of what action is set to be taken, the attachment is always removed and a warning message is attached instead.

Use the TLS connections section to set firewall behavior for cases where both mail client and the server support TLS-secured SMTP or POP3 traffic.

In case that TLS protocol is used, unencrypted connection is established first. Then, client and server agree on switching to the secure mode (encrypted connection). If the client or the server does not support TLS, encrypted connection is not used and the traffic is performed in a non-secured way.

If the connection is encrypted, firewall cannot analyze it and perform antivirus check for transmitted messages. WinRoute administrator can select one of the following alternatives:

- Enable TLS. This alternative is suitable for such cases where protection from wiretapping is prior to antivirus check of email.

  ### Hint

  In such cases, it is recommended to install an antivirus engine at individual hosts that would perform local antivirus check.

- Disable TLS. Secure mode will not be available. Clients will automatically assume that the server does not support TLS and messages will be transmitted through an unencrypted connection. Firewall will perform antivirus check for all transmitted mail.

The If an attachment cannot be scanned section defines actions to be taken if one or multiple files attached to a message cannot be scanned for any reason (e.g. password-protected archives, damaged files, etc.):

- Reject the attachment — WinRoute reacts in the same way as when a virus was detected (including all the actions described above).

- Allow delivery of the attachment — WinRoute behaves as if password-protected or damaged files were not infected.

  Generally, this option is not secure. However, it can be helpful for example when users attempt to transmit big volume of compressed password-protected files (typically password-protected archives) and the antivirus is installed on the workstations.

Prev | Up | Next
13.3 HTTP and FTP scanning | Contents | 13.5 Scanning of files transferred via Clientless SSL-VPN (Windows)