kruisdraad / sima

SIMA

Scan Inventory for Mail Attachments

Disclaimer

This tool is still under development, so you might missing or looking at incomplete commands. If you find any bugs, please report them.

Installation

• Check out this repository to /opt/sima/
• Create database, user and schema:

mysql -e "CREATE DATABASE sima;"
mysql -e "CREATE USER 'sima'@'localhost' IDENTIFIED BY 'some_secret_password';"
mysql -e "GRANT ALL PRIVILEGES ON sima.* TO 'sima'@'localhost';"
mysql -u sima -psome_secret_password -d sima < /opt/sima/database/schema.sql

• Configure application:

vi /opt/sima/config/database.yml
vi /opt/sima/config/mail.yml
vi /opt/sima/config/avtotal.yml
vi /opt/sima/config/base.yml

• Configure Amavis:

For Ubuntu, edit /etc/amavis/conf.d/15-av_scanners and add:

@av_scanners = (
  ### SIMA / Scan Inventory for Mail Attachments
  ['SIMA', ['/opt/sima/bin/sima'],
    'scan {}', [0], qr/Found bad hash/m, qr/Found bad hash (.+) in/m ],
)

This will ONLY start to collect information. If you change the 'scan {}' into 'scan -f {}' the filter policy will be applied. Do not enable filtering unless you have testing correct working of the system FIRST.

Stuff to do

• Create central API to exchange hash information (replace AVTotal API)
• Exchange hashes with mail vendors to build a large database
• Create filtering and policy builder

sima's Issues

improve mysql database schema

currectly a single table ...

Add original filenames

amavis removes the filenames, which is not handy. There is an e-mail.txt which we could mime parse ourselves.

includes un-archiving-en archives and such.

Add e-mail UUID

now amavis adds multiple parts within the same scan. each scan should get a UUID-4 so that files from the same e-mail can be found.

Needs an search option too (as well as show, perhaps even bulk blacklist)