Is there any way to stop users from sending attachments over Gmail or any web based email including private mail servers, if internet access is through a Linux box running Ip Tables/Squid etc. We are looking for a free/open source tool. Can this be achieved through Squid or IPTables/Shorewall?
2
-
Several commercial products (IronPort, Palo Alto) have this ability if they are inline between the hosts. This requires some fairly advanced proxy capability and application awareness that may not be available out-of-the-box in a free/OSS package.– adricCommented Apr 24, 2012 at 12:05
-
2You'd need an SSL intercepting proxy, and those are evil.– CodesInChaosCommented Apr 24, 2012 at 12:14
Add a comment
|
2 Answers
Not really, no.
Firstly, when the traffic in question is passing through your proxy server, it's just web traffic - it's not an email yet. So to just block attachments, your proxy would have to read the traffic in great detail, and understand how to tell when every sort of web mail is moving an attachment.
That would be difficult but possible, although it would be hard to be sure you were catching everything: but you also have to consider that Gmail and many other web email providers support https, which means the traffic might be encrypted as it goes through the proxy, and so you have no way of reading it.
-
you could block against the http upload step... That bit is a standard protocol. SSL is still an issue though.– ewanm89Commented Apr 24, 2012 at 12:36
-
-
@ramdaz, I was pointing out the attachment uploading is usually a http upload, one could set squid or similar to block all http uploads in theory. Of course if the webmail client also accepts a http URL (so the attachment is a file stored somewhere else on the net) or has some flash uploader using a custom protocol or something else it's not going to catch it.– ewanm89Commented Apr 24, 2012 at 17:44
Ramdaz,
A tad bit off topic but realted none the less. If the ultimate goal is to prevent malicious downloads and you are running a windows domain might I suggest using an ESR GPO to help mitigate the vulnerability.
And FYI there are ways to read the SSL encrypted web traffic despite the encryption, it just requires a little web proxy magic along with a GPO for trusted CA's.
If you are working with squid and would like to proxy ssl to get more fidelity on ssl encrypted email traffic start here..http://wiki.squid-cache.org/Features/SslBump (Make sure you include your lawyers when you write the policies if you decide to use this )
Disclaimer: do not expect squid to now block web based email attachments, this solution will just allow you to have more oversight of what is coming in and out of your network.
dc
-
-
Ramdaz do you currently use a web proxy? i'll pull some info for your personal proxy solution.– dc5553Commented Apr 24, 2012 at 13:15
-
i see you spoke of squid web proxy, in squid they use the term ssl bumping, this technique with internet explorer group policy settings to automatically trust that certificate you use for bumping could potentially be a transparent ssl proxying solution for your enterprise.– dc5553Commented Apr 24, 2012 at 13:20