List user's email behaviour. Best approach?

2001-02-14 Thread Jeff_Newton


What I would like to do is be able to get an idea of a user's email
history; who they mailed, received mail from, what was the subject, and
what was the size (or if there was an attachment).  This information
would be useful in determining if there any potential loses of
intellectual property via email.

Has anyone tried to do this?  Can anyone suggest a good approach to
take?

Cheers,

-- 
Jeff Newton
Security Analyst



Re: List user's email behaviour. Best approach?

2001-02-14 Thread Charles Cazabon

Jeff_Newton [EMAIL PROTECTED] wrote:
 
 What I would like to do is be able to get an idea of a user's email
 history; who they mailed, received mail from, what was the subject, and
 what was the size (or if there was an attachment).  This information
 would be useful in determining if there any potential loses of
 intellectual property via email.

Well, I disagree with your premise:  it will only catch accidental or
incompetent attempts to ship proprietary IP through email.

 Has anyone tried to do this?

Many people.  The FBI recently has had some publicity about a similar scheme.

 Can anyone suggest a good approach to take?

Use qmail's QUEUE_EXTRA feature to send a copy of every message to a given
alias, controlled by a .qmail file.  In that file, pipe messages to a script
which uses something (mess822, perl, awk, you name it) to record the
envelope sender (Return-Path:), envelope recipient (hmmm, a bit trickier,
probably have to parse To:, etc), subject, and date.

This is documented in Dan's qmail FAQ.

Charles
-- 
---
Charles Cazabon[EMAIL PROTECTED]
GPL'ed software available at:  http://www.qcc.sk.ca/~charlesc/software/
Any opinions expressed are just that -- my opinions.
---