This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

I'd really like to be able to let smime.p7s through the gateway.

I'm using the recommended Sophos Settings, I changed it to Manual to look for smime.p7s and its not listed so I changed it back.

I made a keyword rule for smime.p7s today and set to log and to continue processing, but I am not sure if the Attachment File Rule underneath it will block it anyway.

I know I could turn off continue processing, but then I'm paranoid that my custom rule might let something else through.

Both of my company owners are getting annoyed at having to contact the IT every time they receive a mail with smime.p7s to have us release it from the quarantine.

Does anyone have a decent solution for this?

Edited tags
[edited by: Raphael Alganes at 1:11 AM (GMT -7) on 8 Jun 2023]

Top Replies

APEXIT over 4 years ago +1

I also need this fixed. It is a shame that we're blocking security measures that need to be implemented in email. Please provide a proper solution to not allowing all .crt, but allowing smime.p7s files…

Parents

0 emmosophos over 4 years ago

Hello Shawn,

Thank you for contacting the Sophos Community!

What is the reason in Sophos Central email currently, that the emails with p7s are getting quarantined?

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 4 years ago in reply to emmosophos

Central is using True-File-Type Detection.

So actually the P7S will be looked at the real filetype is a certificate. See: https://stackoverflow.com/questions/21056781/how-to-get-mime-type-of-p7s-files

Its not actually p7s, instead it is using .der. So thats the reason, Central is not listing p7s. If you use a DLP rule for the cert types like der, it should hit by p7s files.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 LuCar Toni over 4 years ago in reply to emmosophos

Central is using True-File-Type Detection.

So actually the P7S will be looked at the real filetype is a certificate. See: https://stackoverflow.com/questions/21056781/how-to-get-mime-type-of-p7s-files

Its not actually p7s, instead it is using .der. So thats the reason, Central is not listing p7s. If you use a DLP rule for the cert types like der, it should hit by p7s files.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Shawn Adams over 4 years ago in reply to LuCar Toni

Thank you Tony,

IMO If Sophos is going to call it P7s then it should be in the list as P7s.

Here is the current "Use Sophos list(recommended)" Certificates list, only .crt is check marked. .der is not.

.arm
.cer
.cert
.crt √
.der
.p12
.pem
.pfx
Cancel
Vote Up 0 Vote Down

Cancel