Is there any way to stop users from sending attachments over Gmail or any web based email including private mail servers, if internet access is through a Linux box running Ip Tables/Squid etc. We are looking for a free/open source tool. Can this be achieved through Squid or IPTables/Shorewall?

  • Several commercial products (IronPort, Palo Alto) have this ability if they are inline between the hosts. This requires some fairly advanced proxy capability and application awareness that may not be available out-of-the-box in a free/OSS package.
    – adric
    Apr 24 '12 at 12:05
  • 2
    You'd need an SSL intercepting proxy, and those are evil. Apr 24 '12 at 12:14

Not really, no.

Firstly, when the traffic in question is passing through your proxy server, it's just web traffic - it's not an email yet. So to just block attachments, your proxy would have to read the traffic in great detail, and understand how to tell when every sort of web mail is moving an attachment.

That would be difficult but possible, although it would be hard to be sure you were catching everything: but you also have to consider that Gmail and many other web email providers support https, which means the traffic might be encrypted as it goes through the proxy, and so you have no way of reading it.

  • you could block against the http upload step... That bit is a standard protocol. SSL is still an issue though.
    – ewanm89
    Apr 24 '12 at 12:36
  • ewanm89, how do stop through standard protocol
    – ramdaz
    Apr 24 '12 at 13:01
  • @ramdaz, I was pointing out the attachment uploading is usually a http upload, one could set squid or similar to block all http uploads in theory. Of course if the webmail client also accepts a http URL (so the attachment is a file stored somewhere else on the net) or has some flash uploader using a custom protocol or something else it's not going to catch it.
    – ewanm89
    Apr 24 '12 at 17:44


A tad bit off topic but realted none the less. If the ultimate goal is to prevent malicious downloads and you are running a windows domain might I suggest using an ESR GPO to help mitigate the vulnerability.

And FYI there are ways to read the SSL encrypted web traffic despite the encryption, it just requires a little web proxy magic along with a GPO for trusted CA's.

If you are working with squid and would like to proxy ssl to get more fidelity on ssl encrypted email traffic start here..http://wiki.squid-cache.org/Features/SslBump (Make sure you include your lawyers when you write the policies if you decide to use this )

Disclaimer: do not expect squid to now block web based email attachments, this solution will just allow you to have more oversight of what is coming in and out of your network.


  • I am interested in specifics.
    – ramdaz
    Apr 24 '12 at 13:00
  • Ramdaz do you currently use a web proxy? i'll pull some info for your personal proxy solution.
    – dc5553
    Apr 24 '12 at 13:15
  • i see you spoke of squid web proxy, in squid they use the term ssl bumping, this technique with internet explorer group policy settings to automatically trust that certificate you use for bumping could potentially be a transparent ssl proxying solution for your enterprise.
    – dc5553
    Apr 24 '12 at 13:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.