This article applies to:

• Trustwave MailMarshal (SEG)
• Trustwave ECM/MailMarshal Exchange 7.X
• Note that options depend on the product version - see text below

Question:

• How does attachment fingerprinting work in Trustwave SEG/MailMarshal?
• How do I allow the passage of selected email attachments while blocking most or all other attachments?
• How does SEG match valid fingerprints?

Information:

Trustwave SEG (and ECM) supports a function called attachment fingerprinting. This function allows attached files that have been added to the list of valid fingerprints to pass through SEG despite the presence of a generic rule to block this type of file. This option is good for customers who want to include a company logo in outgoing e-mails or in documents.

Note: This option is not intended for use with large numbers of images. For instance, it should not be used to identify images found in spam messages. When large numbers of images are added, restarting the SEG services can take a very long time.

SEG matches valid fingerprints by performing a Cyclic Redundancy Check  (CRC - a simple hashing algorithm) count on the content of the document.

SEG creates a ValidFingerprints directory within the Quarantine directory of the install on each email processing server, where it stores fingerprint information. To work correctly, the ValidFingerprints directory must be located on an NTFS partition. 

There are several ways to add files for fingerprinting to the ValidFingerprints directory:

• When you use the Console to release blocked e-mail, you can add attachments to the list of valid fingerprints (not available in version 6.5).
• You can allow or deny use of the Console action for each folder. For details see the User Guide and Help (SEG 6.7 and above, ECM 7.X).
  • To add a fingerprint, you must choose this release option for each message (by clicking a hyperlink in the release window).
  • You cannot use the "pass through" option for messages when adding fingerprints. A message that is passed through will not have fingerprints added, because it is not processed by the Engine. (The interface allows you to select this combination of actions but it will not have any effect.)
• You can set up a rule to add an attachment to the fingerprints folder (based on a key phrase in the e-mail message). This option may be useful to Administrators who want to remotely add files.
• You can place a file into the fingerprints directory and restart the Engine service.

Notes:

• OLE embedded images in Microsoft Word documents may not be recognized when the image is added by placing a file in the fingerprints directory manually. Microsoft Word may store the images in a different format. To ensure accuracy, either of the other methods of adding fingerprints is preferred.
• When a fingerprint is added (manually or by rule action) on one processing server, the fingerprint information is replicated to other processing servers by being logged to the Array Manager and posted to the other servers. This process can take a number of minutes to complete.

This article was previously published as:

NETIQKB29017