Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

Is there any way to stop users from sending attachments over Gmail or any web based email including private mail servers, if internet access is through a Linux box running Ip Tables/Squid etc. We are looking for a free/open source tool. Can this be achieved through Squid or IPTables/Shorewall?

share|improve this question
Several commercial products (IronPort, Palo Alto) have this ability if they are inline between the hosts. This requires some fairly advanced proxy capability and application awareness that may not be available out-of-the-box in a free/OSS package. – adric Apr 24 '12 at 12:05
2  
You'd need an SSL intercepting proxy, and those are evil. – CodesInChaos Apr 24 '12 at 12:14

2 Answers

up vote 3 down vote

Not really, no.

Firstly, when the traffic in question is passing through your proxy server, it's just web traffic - it's not an email yet. So to just block attachments, your proxy would have to read the traffic in great detail, and understand how to tell when every sort of web mail is moving an attachment.

That would be difficult but possible, although it would be hard to be sure you were catching everything: but you also have to consider that Gmail and many other web email providers support https, which means the traffic might be encrypted as it goes through the proxy, and so you have no way of reading it.

share|improve this answer
you could block against the http upload step... That bit is a standard protocol. SSL is still an issue though. – ewanm89 Apr 24 '12 at 12:36
ewanm89, how do stop through standard protocol – ramdaz Apr 24 '12 at 13:01
@ramdaz, I was pointing out the attachment uploading is usually a http upload, one could set squid or similar to block all http uploads in theory. Of course if the webmail client also accepts a http URL (so the attachment is a file stored somewhere else on the net) or has some flash uploader using a custom protocol or something else it's not going to catch it. – ewanm89 Apr 24 '12 at 17:44
up vote 1 down vote

Ramdaz,

A tad bit off topic but realted none the less. If the ultimate goal is to prevent malicious downloads and you are running a windows domain might I suggest using an ESR GPO to help mitigate the vulnerability.

And FYI there are ways to read the SSL encrypted web traffic despite the encryption, it just requires a little web proxy magic along with a GPO for trusted CA's.

If you are working with squid and would like to proxy ssl to get more fidelity on ssl encrypted email traffic start here..http://wiki.squid-cache.org/Features/SslBump (Make sure you include your lawyers when you write the policies if you decide to use this )

Disclaimer: do not expect squid to now block web based email attachments, this solution will just allow you to have more oversight of what is coming in and out of your network.

dc

share|improve this answer
I am interested in specifics. – ramdaz Apr 24 '12 at 13:00
Ramdaz do you currently use a web proxy? i'll pull some info for your personal proxy solution. – dc5553 Apr 24 '12 at 13:15
i see you spoke of squid web proxy, in squid they use the term ssl bumping, this technique with internet explorer group policy settings to automatically trust that certificate you use for bumping could potentially be a transparent ssl proxying solution for your enterprise. – dc5553 Apr 24 '12 at 13:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.