Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #242247 > unrolled thread

Simple way to scann all incoming and outgoing e-mails for viruses

Back to article view | Back to linux.debian.user

Contents

  Simple way to scann all incoming and outgoing e-mails for viruses john doe <johndoe65534@mail.com> - 2021-11-19 08:20 +0100
    Re: Simple way to scann all incoming and outgoing e-mails for viruses Dan Ritter <dsr@randomstring.org> - 2021-11-19 12:50 +0100
    Re: Simple way to scann all incoming and outgoing e-mails for viruses Henning Follmann <hfollmann@itcfollmann.com> - 2021-11-19 17:50 +0100
      Re: Simple way to scann all incoming and outgoing e-mails for viruses Curt <curty@free.fr> - 2021-11-19 18:40 +0100
      Re: Simple way to scann all incoming and outgoing e-mails for viruses john doe <johndoe65534@mail.com> - 2021-11-21 14:50 +0100

#242247 — Simple way to scann all incoming and outgoing e-mails for viruses

Debians,

My MUA is connecting to mail.com for imap and smtp.
I have a Debian gateway server that I would like to use to scann e-mails
sent and reseaved.

Is there a way to scann incoming and outcoming e-mails on those ports
for viruses?

What I'm trying to avoid is to change the connection settings in my MUAs.

I'm not sure how realistic this is so I might refine my question based
on the provided answers.

--
John Doe

[toc] | [next] | [standalone]

#242248

john doe wrote: 
> Debians,
> 
> My MUA is connecting to mail.com for imap and smtp.
> I have a Debian gateway server that I would like to use to scann e-mails
> sent and reseaved.
> 
> Is there a way to scann incoming and outcoming e-mails on those ports
> for viruses?
> 
> What I'm trying to avoid is to change the connection settings in my MUAs.
> 
> I'm not sure how realistic this is so I might refine my question based
> on the provided answers.

Intercepting IMAP and SMTP transparently is plausible, but if
you're using SSL/TLS encryption - and you probably are - not easy.

Mail can be scanned:
    - by an MTA when it arrives via SMTP
    - by an MTA calling a plug-in after the mail has arrived
    - by an MTA calling a plug-in while delivering to a mailbox
    - by an independent agent looking at a mailbox
    - by an MUA after it picks up mail

What are your actual restrictions? Tell us more about your
situation.

For instance, if one of your MUAs is a phone running an email
client pointed at mail.com, you will need to convince it to
accept your own SSL certificate authority -- and even then, this
will only work when your gateway is routing network traffic for
the device.

On the other hand, running a mail server that grabs your mail
from mail.com (with your username and password) and then makes
it available to you via IMAP and SMTP is relatively easy, but
does require changing your MUA connections from mail.com to your
mail server.

-dsr-

[toc] | [prev] | [next] | [standalone]

#242254

On Fri, Nov 19, 2021 at 08:11:26AM +0100, john doe wrote:
> Debians,
> 
> My MUA is connecting to mail.com for imap and smtp.
> I have a Debian gateway server that I would like to use to scann e-mails
> sent and reseaved.

What does that mean?
Can you please be more specific.


> 
> Is there a way to scann incoming and outcoming e-mails on those ports
> for viruses?

Yes

> 
> What I'm trying to avoid is to change the connection settings in my MUAs.

If I understand your first line correctly you are connecting directly with
your MUA to connect to the imap server of mail.com.
In this case you have to scan with your MUA.

> 
> I'm not sure how realistic this is so I might refine my question based
> on the provided answers.

I am not familiar with mail.com. But do they scan and set any header
based on the scan?
In that case you might to create a imapsieve filter on the imap server
to sort suspicious mail into a spam folder.


> 
> --
> John Doe
> 

-- 
Henning Follmann           | hfollmann@itcfollmann.com

[toc] | [prev] | [next] | [standalone]

#242255

On 2021-11-19, Henning Follmann <hfollmann@itcfollmann.com> wrote:
> On Fri, Nov 19, 2021 at 08:11:26AM +0100, john doe wrote:
>> Debians,
>> 
>> My MUA is connecting to mail.com for imap and smtp.
>> I have a Debian gateway server that I would like to use to scann e-mails
>> sent and reseaved.
>
> What does that mean?
> Can you please be more specific.
>
>
>> 
>> Is there a way to scann incoming and outcoming e-mails on those ports
>> for viruses?
>
> Yes
>
>> 
>> What I'm trying to avoid is to change the connection settings in my MUAs.
>
> If I understand your first line correctly you are connecting directly with
> your MUA to connect to the imap server of mail.com.
> In this case you have to scan with your MUA.

That's not how I'm understanding him. I think he wants something like
https://www.mailscanner.info/ on the gateway, which would pass things
on to and from the MUAs transparently. 

>> I'm not sure how realistic this is so I might refine my question based
>> on the provided answers.
>
> I am not familiar with mail.com. But do they scan and set any header
> based on the scan?
> In that case you might to create a imapsieve filter on the imap server
> to sort suspicious mail into a spam folder.
>
>
>> 
>> --
>> John Doe
>> 
>


-- 

[toc] | [prev] | [next] | [standalone]

#242291

On 11/19/2021 5:39 PM, Henning Follmann wrote:
> On Fri, Nov 19, 2021 at 08:11:26AM +0100, john doe wrote:
>> Debians,
>>
>> My MUA is connecting to mail.com for imap and smtp.
>> I have a Debian gateway server that I would like to use to scann e-mails
>> sent and reseaved.
>
> What does that mean?
> Can you please be more specific.
>
>
>>
>> Is there a way to scann incoming and outcoming e-mails on those ports
>> for viruses?
>
> Yes
>
>>
>> What I'm trying to avoid is to change the connection settings in my MUAs.
>
> If I understand your first line correctly you are connecting directly with
> your MUA to connect to the imap server of mail.com.
> In this case you have to scan with your MUA.
>
>>
>> I'm not sure how realistic this is so I might refine my question based
>> on the provided answers.
>
> I am not familiar with mail.com. But do they scan and set any header
> based on the scan?
> In that case you might to create a imapsieve filter on the imap server
> to sort suspicious mail into a spam folder.
>

Hello all and thank you for your answers.

I'll answer here to everyone who has contributed.

I was hoping to transparently intercept e-mails and scann then for viruses.
So when connected at home the e-mail would be scann for viruses and if I
connect to a public network the connection to mail.com would also work.

By the answers I got here, this looks to be difficult to implement
especially when SSL is involved.

My network is as follow:
I have one debian server behind my ISP modem that act as gateway for my
private netowrk.
There are multiple users on my network on multiples OSs (Windows,
Android and linux) with different MUAs.
Eatch MUAs is configured with multiple e-mail accounts.

For the sake of learning, I would like to make my own set up and not
relying on what mail.com can provide.


What would be the best way forward here with multiples MUAs and multiple
e-mail accounts?

I do get that I would need to set up a MTA on my server and connect to
that MTA changing my connections settings in my MUAs.

In other words, I'm open to any suggestions.

A big thank you to 'Dan Ritter <dsr@randomstring.org>' and to 'Curt
<curty@free.fr>' and also to you 'Henning Follmann
<hfollmann@itcfollmann.com>'.

--
John Doe

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web