Subject: content filter for http, ftp and mail

From: Frank Neuber <[email-masked]>
Date: Sun, 7 Jan 2001 19:44:17 +0100 (CET)

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi fwtk-users,
I have no experience with fwtk but I am looking for an firewall that can 
do content filtering on e-mail and http under linux.

I have to set up a firewall with ip-filter, virus scanning and free
configurable content filtering. AFAIK ip-filter and and virus scanning is
not the problem ... But I can't find a solution for my content filtering
problem. The content filter should provide some features:
1. Blocking html-requests with "junk" in the url (I think that can I do
with a http-Proxy ?)
2. Blocking html-pages with "junk" in the body (I have no idea how can I
do that) 
3. The same behavior for ftp and e-mail

With "junk" I mean a database with keywords. This database should be free
configurable.

Is is possible to do this with the tis-firewall? I did not found anything
of this topic in the tis-documentation.
Maybe it is possible to integrate a commecial product in the tis-firewall?
Has anyone an advice or experience in an software that can do content
filtering under Linux (commecial products also welcome).

thanks in advance  

Frank

-- 
     _/_/_/_/ _//   _/ Frank Neuber
    _/       _/_/  _/  [email-masked] (private)
   _/_/_/   _/ _/ _/
  _/       _/  _/_/    [email-masked]
 _/       _/    // http://www.opensource-systemberatung.de

---

From: Ted Keller <[email-masked]>
Date: Sun, 7 Jan 2001 19:09:44 -0500 (EST)

Frank,

I haven't seen this type of filtering for http or ftp.  However, my
version of the smap/smapd probably has most of the filtering you would
need for mail.  I do content filtering on both the message header
(subject, from, to, and other fields) as well as content filtering on the
message body (first 10 lines).

It doesn't yet do anything with html code burried in the body.  Keep
thinking about getting around to it - but haven't done it yet.

The filters were orginally gotten from 

   Linkname: Oasel the Spam-Catcher's Report to the Nation              
        URL: http://www.cnx.com/stopspam.html

I've sense updated it with the many local entries we receive here.

Tend to block ~15,000+ messages weekly - out of 200,000 total e-mail
messages we recieve.  Doesn't hit everything - but sure eliminates the
15,000 junk ones we do get.

I can make this available to you if you are interested (standard
disclaimers apply).

ted keller

---

From: Frank Neuber <[email-masked]>
Date: Mon, 8 Jan 2001 10:34:36 +0100 (CET)

On Sun, 7 Jan 2001, Ted Keller wrote:

Hi Ted,
thanks for this quick response.
I will check out this link below.
>         URL: http://www.cnx.com/stopspam.html
I'm also never seen content filtering for http and ftp, but it is a
customer wish ....

Frank

---

From: Laurence Moore <[email-masked]>
Date: Mon, 8 Jan 2001 21:01:51 +0800 (WST)

Check out Trends Interscan Viruswall.

There is a version for Linux

Here is the URL - http://www.antivirus.com

Cheers,

Larry.

---

From: Frank Neuber <[email-masked]>
Date: Mon, 8 Jan 2001 15:16:58 +0100 (CET)

On Mon, 8 Jan 2001, Laurence Moore wrote:

Hi Laurence,
yesterday evening I tested the 30 day trail-version of the 
Trends Interscan Viruswall.
I think this is the virusscanner I want :-)
There is also a content checker for e-mail "eManager" as an plugin for the 
Interscan Viruswall. Unfortunately not for Linux. The supportcenter of
germany said:
 "the eManager is not planned in the near future for linux"

.... :-(

> Here is the URL - http://www.antivirus.com

If anybody has an advice for content filtering about my subject, please
let me know.

Cheers,

Frank

---

From: Laurence Moore <[email-masked]>
Date: Tue, 9 Jan 2001 01:41:29 +0800 (WST)

Hmmm,

There was a product on their site that does smtp, http & ftp filtering
whilst also having the virus scanner for scanning files.

I'll have to dig out my eval. CD from Trend Micro and have a look.

I have attached the readme from the Linux section of the evaluation CD.

As you can see from the listing files in this directory certainly suggest 
ftp, http and smtp scanners however you will need to install isbase
before you can use the listener daemons.

-r-xr-xr-x  1 root  wheel     4117 Nov  2  1999 Readme.txt
-r-xr-xr-x  1 root  wheel  1151138 Nov  2  1999 isadm.tz
-r-xr-xr-x  1 root  wheel  2143939 Nov  2  1999 isbase.tz
-r-xr-xr-x  1 root  wheel   156484 Nov  2  1999 isftp.evl
-r-xr-xr-x  1 root  wheel   155409 Nov  2  1999 isftp.tz
-r-xr-xr-x  1 root  wheel   193413 Nov  2  1999 ishttp.evl
-r-xr-xr-x  1 root  wheel   191475 Nov  2  1999 ishttp.tz
-r-xr-xr-x  1 root  wheel    90847 Nov  2  1999 isinst
-r-xr-xr-x  1 root  wheel   185396 Nov  2  1999 issmtp.evl
-r-xr-xr-x  1 root  wheel   182818 Nov  2  1999 issmtp.tz
-r-xr-xr-x  1 root  wheel   222513 Nov  2  1999 istvcs.tz
-r-xr-xr-x  1 root  wheel     6119 Nov  2  1999 license.txt

I have moved away from Linux to OpenBSD. I have been searching for at
least a suitable Virus and E-Mail scanner and I am presently playing with
AvMailGate and AntiVir from http://www.hbedv.com

Cheers,

Larry.

---

From: Laurence Moore <[email-masked]>
Date: Tue, 9 Jan 2001 02:42:51 +0800 (WST)

As far as scanning of http is concerned, if it for offensive, pornographic
etc type content then you could look at

SquidGuard: http://www.squidguard.org  (I think)

If you are wanting to detect malicious objects within the web document
beit Java, Active-X then you would need to be looking at a commercial
scanner such as Trends InterScan VirusWall (per previous e-mail).

Cheers,

Larry