topic Block password protected archive - MTA in AI Network Firewall

Block password protected archive - MTA

cir007 — Fri, 14 Apr 2023 09:48:48 GMT

Hello mates,

is there a way to block password protected archive files that are going through MTA.

Is the command tecli advance error set archive_pass_protected fail_close the way to go? I know I can block archive files (.zip .rar etc) via AV blade, but I can scan the ones that are not pass protected - using multiple local CP TE appliances. My question is if the tecli command is the way to go, should I issue it on MTA GW and on TE GW or only MTA, or is there a better way all together? Can I be sure that all archive files will always reach ted in order to enforce this action - not passed by static analysis?

This is my mail flow:

mail--->MTA-GW---->mail server
↓ ↑
TE2000XN

Br jb1

Re: Block password protected archive - MTA

PhoneBoy — Fri, 14 Apr 2023 23:57:17 GMT

I believe using the tecli command you specify is the way to go here.
Not 100% sure if you execute it on the TE GW, MTA GW, or both.
My suggestion would be to try the TE GW first.

Re: Block password protected archive - MTA

cir007 — Thu, 08 Jun 2023 07:38:28 GMT

Just to let you guys know, the command tecli advance error set archive_pass_protected fail_close was the way to go. Run it on MTA GW/cluster.

Re: Block password protected archive - MTA

_Val_ — Thu, 08 Jun 2023 12:49:01 GMT

thanks for sharing