README
¶
Simple heuristic daemon to classify email cryptography
This daemon was written to collect statistics of email cryptography usage using exim. It uses a simple heuristic to detect if an email was signed or encrypted using S/MIME (CMS) or PGP.
Installation
Building
Install go (tested with versions 1.4 and 1.7.1). Run
go build
Copy mailcryptoinfo to /usr/local/bin (or choose another location and adjust the systemd-unit
accordingly).
Configure exim
To use this in parallel to clamd, set this globally:
av_scanner = $acl_m0
Then add this to your clamd ACLs:
set acl_m0 = clamd:/var/run/clamav/clamd.ctl
Add something like this to your acl_smtp_data ACL:
warn
set acl_m0 = sock:127.0.0.1 48879:%s:(RESULT):RESULT (.*)\$
malware = *
log_message = mailcrypto found $malware_name
To prevent counting messages more than one, consider implementing something like this
system configuration
Use your distribution's prefered method to start this daemon before exim. A (debian specific) systemd file is included here:
cp systemd/mailcryptinfo.service /etc/systemd/system/
systemctl daemon-reload
systemctl start mailcryptinfo.service
systemctl status mailcryptinfo.service
systemctl enable mailcryptinfo.service
FAQ
Q: Why not use exim to implement your heuristic?
Because exim does not give me access to then Content-Header's options. Plus I am considering adding signature validation which can't be done in native exim.
Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var (
EmptyCryptoInfo = &CryptoInfo{}
)
var (
EmptyMailFile = &MailFile{}
)
Functions ¶
func ScanMailfile ¶
Types ¶
type ConditionalLogger ¶
type ConditionalLogger interface {
Enable()
Disable()
Println(...interface{})
Printf(string, ...interface{})
}
type CryptoInfo ¶
type CryptoInfo struct {
// contains filtered or unexported fields
}
CryptoInfo implements MailAnalyzer
func NewCryptoInfo ¶
func NewCryptoInfo(e EMail) *CryptoInfo
NewCryptoInfo creates a new crypto analysis from an email
func (*CryptoInfo) Result ¶
func (ci *CryptoInfo) Result() map[string]string
Result returns a result map
func (*CryptoInfo) Set ¶
func (ci *CryptoInfo) Set(key, value string)
set/overwrite a key/value pair in the result map
func (*CryptoInfo) String ¶
func (ci *CryptoInfo) String() string
type HandlerMessage ¶
type MailAnalyzer ¶
MailAnalyzer models a map of result of an analysis
type MailFile ¶
type MailFile struct {
// contains filtered or unexported fields
}
MailFile holds an email filename and a parsed version
func NewMailFile ¶
NewMailFile creates a new MailFile from a file
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
func NewService ¶
func NewService() *Service
func (*Service) Serve ¶
func (s *Service) Serve(listener *net.TCPListener)
Accept connections and spawn a goroutine to serve each one. Stop listening if anything is received on the service's quit channel.
Source Files
Directories