Hello, Great posts everyone, I have really learned a lot from your input and it's very much appreciated.
> As I read it, he's looking at "random users accessing random servers" > - eg a user connecting his phone to the guest network and it then > accessing Gmail. Yes, this was exactly the concept I was asking about, although I suspected somehow it had inconsistencies within but I needed help dissecting. Given the principles outlined in the messages, how feasible would it be to modify the concept to this framework: > In a corporate environment, with control of the clients, it's > possible to install your own root certificate on the clients and then > use that to sign the client-side connection... * That's what I could do for known clients and defer the unknown clients problem to some future date, perhaps creating a separate infrastructure for them. * Currently all known clients use corp domain Gmail, but that does not mean that at some future date user X wouldn't wish to add some other email service to his MUA. > ... For maximum forgettability and better user protection I'd > ... get the remote server to do the scanning. Gmail already does a pretty good job of it most likely. Perhaps I'm being paranoid, but you know how it goes with these things. > ... I think you'd need some complexity just for example to be able to > use third-party databases... GW - Not sure I'm not fully grasping this point. I thought I could install the 3rd part tools and keep them up to date with cron jobs? The gateway will also be running suricata IDS and that's another layer of complexity. It creates an overlap problem with ClamAV I suspect, so I was planning to limit ClamAv to tasks not available in suricata. > ... If you spend some quality time in the archives you'll probably > see the sorts of things that can happen ... Yes I did see a number of posts re "things that can go wrong". I was going to get to that after solving the conceptual question - this problem continued below. > ... If clamd finds something (it does happen), what's the plan? > The message is *already* in the user's mail box, and I'd say it should > *not* be there in your scenario, because the user can pick up the bad > mail simply by connecting other than through your gateway. I was thinking "somehow" to move the email to a quarantine folder and then sending an advisory to the user "message from joe has been quarantined, please take following steps". Perhaps even some process to strip all attachments, convert message to text-only (risky?) and send the text-only content along with the advisory. Moving the message to quarantine folder on the host server (Gmail) would require user credential by MTA, so there's another hole in my concept. I wonder if there's an MTA that stores hashed credentials but is also able to auto-update such credentials as received from client device / MUA so that no direct user interaction with the Gateway is necessary. Thank you again everyone for your time and valuable input. Regards. -- HardenedBSD_amd64_12-Current_RadeonKMS Please CC my email when responding, mail from list is not delivered. _______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
