User Tools

Site Tools


how_to:attachments_have_been_removed_or_renamed
no way to compare when less than two revisions

Differences

This shows you the differences between two versions of the page.


Previous revision
how_to:attachments_have_been_removed_or_renamed [2018/11/14 10:45] (current) – external edit 127.0.0.1
Line 1: Line 1:
 +======Attachments have been removed or renamed======
 +If you have received an email and one or more of its attachments have been removed or renamed, it might be a result of [[how_to:filtering_attachments|Attachment Filtering]].
  
 +You can inspect the filtering rules by going to Administration Settings -> Settings -> Attachment Processing -> Filtering
 +
 +=====Double-extension=====
 +One common scenario is where dates or other bits of information are included in the filename and separated by dots.
 +This could potentially trigger the following rule:
 +
 +***.???.???**
 +
 +The rule detects a filename that ends in a dot, followed by three characters, followed by another dot, then three more characters. It is designed to prevent a common trick, where filenames are given a pretend extension, in front of the actual one. 
 +The trick is designed to make a recipient think a potentially malicious program is just a typical document. Anyone who is unfamiliar with the way filename extensions work in Windows may mistake that **file.doc.exe** is a Word document and run it.
 +
 +Unfortunately, this also means that some legitimate files may be filtered. For example: a file named **file2011.may.doc** would look suspicious and therefore be filtered, according to that rule.
 +
 +=====Workarounds=====
 +If your attachments are being filtered, there are a few options:
 +
 +  - You might want to ensure **Change filtered attachment extension to make it unrunnable** is selected in the filtering settings
 +    * This ensures the attachment is still accessible, but it would make it difficult for an inexperienced user to open the file. 
 +    * In the rare cases that such an attachment is legitimate, the user can be shown how to save the attachment, rename and open the file. 
 +    * The final character of the extension will be replaced with an underscore, so a Microsoft Word file named **file.123.do_** would usually need to be renamed to **file.123.doc**
 +  - Ask the sender to adjust the way they format their filenames. For example; when writing dates, hyphens (-) and underscores (_) are usually suitable alternatives to dots.
 +  - Redirect all emails with filtered attachments, to a particular user.
 +    * In the filtering settings, select **Redirect messages with filtered attachment to**
 +    * Redirect the messages to a user who has a good understanding of Windows filenames and the sort of files you would expect to receive.
 +    * This user should then forward the messages, if appropriate, to the intended recipient.
 +  - Remove or edit the rule that is filtering the attachment
 +    * This is not recommended, because it exposes users to additional potentially unsafe files. Nonetheless, if filtering is affecting productivity, it may be the only suitable option.
how_to/attachments_have_been_removed_or_renamed.txt · Last modified: 2018/11/14 10:45 by 127.0.0.1