clamav and snat

From: vaida bogdan (vaida.bogdan_at_gmail.com)
Date: 02/18/05

  • Next message: Sten Daniel Sørsdal: "Postfix+Courier-Imap with MySQL." 
    Date: Fri, 18 Feb 2005 18:19:39 +0200
To: freebsd-isp@freebsd.org

    Hy, I use postfix+mailscanner on my mail server to block a lot of
    virii comming from my internal network. I would like to implement a
    solution to block virii traffic on the internal gateway. The network
    looks like this:

    WIN-
    WIN- ----GW1----- -----MAIL SERVER----- -----GW2----
    WIN-

    GW1 does snat:

    Chain POSTROUTING (policy ACCEPT)
    target prot opt source destination
    SNAT all -- intip/24 anywhere to:extip

    One (or more) WIN is infected but I don't know which of the 30
    computers on the network. I receive virused attachments on the MAIL
    SERVER from the GW1's ip. WIN are on the internal network.

    An ideea would be to extract mail traffic passing through GW1 in mbox
    format and scan it with clamav (but it would still have the snatted
    ext ip). I'm looking for better ideeas/implementations. Also, please
    tell me which tool should I use to sniff mail on GW1 or if there is a
    better solution.

    Thanks,
      Vaida Bogdan
    _______________________________________________
    freebsd-isp@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-isp
    To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"

  • Next message: Sten Daniel Sørsdal: "Postfix+Courier-Imap with MySQL."

    Relevant Pages

    • RE: Physical vs. Virtual iface device vulnerability
      ... anyone who compromises your mail server gets complete ... With resolution A, they get only SQL ... > outside my internal network with its own firewall in place. ... > server an internal ip address and set up connection to MySQL ...
      (Security-Basics)
    • Re: Mail server security - best practices?
      ... The mail server in the DMZ does not need to have access to port 25 on ... As a stateful firewall, pf can be ... Is it because email is "quantified" when moved to the internal network? ...
      (comp.unix.bsd.openbsd.misc)
    • [Fwd: Re: Down the MPD road]
      ... Subject: Down the MPD road ... > secure network, as they very definitely need resources from there. ... > the internal network this dog just don't hunt. ... LDAP connections from the MPD'd range to the mail server. ...
      (FreeBSD-Security)
    • Re: need help setting a rule for ftp
      ... > serves as my firewall, mail server, and web server. ... If eth0 connects to your ... internal network, you'd do this (for iptables, though -i exists in iptables ...
      (comp.os.linux.security)
    • Re: clamav and snat
      ... WIN are on the internal network. ... > An ideea would be to extract mail traffic passing through GW1 in mbox ... I'm not familiar with the snat you're using but couldn't you: ... put a transparent smtp proxy to listen on loopback:25 and relay on MIALSERVER ...
      (freebsd-isp)
    • Quantcast