Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

I am studying the Google Safe Browsing.

How do I know that it is possible to intercept a content of an email via amavis, I wonder if I can, for each url found, consult the Google safe browsing?

Do not know much about linux, much less those tools. Any help will be appreciated. Thank you.

share|improve this question
Sounds like a good use for Postfix with pipes and alternate delivery paths. – Jeff Ferland♦ Aug 22 '12 at 19:48
@JeffFerland can you explain a little more about your suggestion? – caarlos0 Aug 22 '12 at 19:57
The best is to integrate Spam Assassin. It's a very good solution for complete email checking and scanning, which is highly effective and has very good detection ratios. – Andrew Smith Aug 22 '12 at 22:11
@caarlos0 I unfortunately didn't have time to write up a helpful answer when I commented and thought a comment would be better than nothing. Chris' answer seems to be sufficient right now unless the asker needs more info. – Jeff Ferland♦ Aug 28 '12 at 21:13

1 Answer

up vote 3 down vote

Yes it would be possible to use the amavisd-new and Google Safe Browsing Lookup API specifications to write an e-mail scanning plugin that would "scan" all URLs in e-mails. The amavisd-new spec is written in Perl, so it would probably be easiest to write the plugin in Perl as well, but not necessary as according to their documentation.

As Andrew mentions, this type of scanning would likely be most useful if integrated in to a larger framework, like SpamAssassin, where it can be a contributing factor to the classification of incoming (or outgoing, in high security environments) e-mail.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.