|
We are using a Linux based Squid firewall in our organization. I want to have an arrangement that whenever any user uploads any file to any internet site ( eg. 4shared.com , etc ) , an email should be generated with the following details -IP of the machine from which the file is uploaded -File name which was uploaded -Date and time when this was uploaded and this email is sent to a set of pre-defined users. Any pointers on how this can be done would be greatly appreciated. thanks
| |||
|
feedback
|
|
The question you have to answer yourself is how does your firewall should recognize that a file is being uploaded? It could be done by farious tunneling methods. Have a look at tools like netcat or scp or even sftp. Your firewall would just recognize a datastream from a client to a server outside. What about SSL encrypted sessions? How do you handle these in your squid proxy? I could even do this with a remote server via http://srv.example.com/?id=chunks_of_file_here. I've done this myself a couple of years ago in a demonstration. Have a look for an intrustion detection system like snort, these tools do stuff like packet inspection, maybe it could detect file transfers. | |||
|
feedback
|
