To run a small software company, I want to use web email services
instead of running an internal mail server. Source code leak via
outgoing email file attachment is a concern.
Question 1: How to filter outgoin web email file attachment?
Question 2: How does web email handle file attachment? Does it trigger some file 
     transfer protocol to upload file attachment? For exmaple, if it uses FTP to 
     upload files, can I block email file attachment by filter FTP protocol?
Thanks

---

Clarification of Question by ibc111-ga on 16 Nov 2005 12:55 PST

* There are many free web email services. Employees could use any of
them to upload sensitive files. Just blocking some popular web email
services (Yahoo, hotmail) is not enough. A generic filtering solution
is needed.
* Can I assume that all emails use MIME types multiparty and message
to do email? If yes, will a filter like this able to block uploading
email file attachment?
  1) check all outgoing emails.
  2) check smtp and http protocols.
  3) check for MIME type. block multiparty (used by file attachment). permit
     if it uses only message type and not multiparty type.
* if the above filter will work, which products can dop the job?

What you might want is to use a web proxy that can filter mime types
going out of your company. For instance, if all your computers goes
thru the web proxy, you can configure it to reject multipart/mime
which is generated by file uploads (considering your proxy supports
the option). I recommend DansGuardian(http://dansguardian.org). It is
easily installable as a full server solution with IPCop (ipcop) which
is a firewall with dansguardian addon. The feature page of
DansGuardian lists : "Can filter according to MIME type and file
extension."

Hi !

answer 2 : the webmail use the HTTP protocol to upload files from user
to server (via a simple form), and then uses standard SMTP protocol to
send the mail.

for the question 1 : there are differents ways to achieve this; one
could be to edit the webmail source code, specially the page concerned
with the upload and to restrict the file type and/or size. This way,
the user could be alerted that the file is wrong or too big.

this should be quite easy to do

is this a popular webmail ? IMP, Squirrelmail or something like that ?
In this case, there must be a way to restrict attachments natively...

Julien.

Sorry for my poor english