|
Hi all,
I am currently studying a solution to provide secure connection to our SMTP
gateway. Our topology can be sum up as follow :
-----------------------
INTERNET
-----------------------
|
+----------------+
| Network router |
+----------------+
|
+---------+
| FW |
+---------+
|
+---------------+ +------------------+ +---------------+
| Loadbalancer1 |=====| Internal Network |======| Loadbalancer2 |
+---------------+ +------------------+ +---------------+
| |
| |
+----------------+
+-------------------------------+
| SMTP antivirus | | MTA server pool
|
| Server pool | | dealing internals SMTP server
|
+----------------+
+-------------------------------+
In fact we have users all around the internet and we want to provide them a
secure access to their mailbox (reading & sending). All the connections
coming from the Internet pass through our antivirus stream. For instance,
if a user want to send a mail from the Internet using our MTA, the strean
is analysed by the antivirus to protect our internal network against
infected mails, SPAM, ... coming from Internet (even if user is granted in
our antivirus system).
If we use clear SMTP protocol all work fine. But (there is always a but :))
to secure the access we want to use secure SMTP connections to our Internal
SMTP server. So an Internet user configure his mail client to use SSL/TLS
over SMTP, so when he send mails from the internet the SMTP stream is
encrypted which prevent us against malicious SMTP sniffing.
The fact is that to scan stream for virus we need to deal with clear
streams. Our antivirus can not deal with encrypted SMTP connections, it is
not natively implemented. A solution can consist in using another SMTP
server pool that deal with encrypted connections. But if we implement that
the SMTP stream can not be scanned and potential infected mail can infect
all our internal network.
So the solution we can implement is a layer 7 switching. In our
Loadbalancer1 we creat two virtual services : first for plain SMTP acting
at layer 3 only loadblancing SMTP antivirus server pool, the second for
SSL/TLS secure port acting at layer 7.
Here it can be interresting : We use something like ktcpvs to loabbalance
secure SMTP connections. When a connection is coming from the Internet to
that virtual service, ktcpvs respond to the certificats exchange and deal
all the secure connection with the remote mail client. Then, when he
receive data from the remote mail client, the stream is decrypted and
forwarded to the SMTP antivirus server pool. So between Loadbalancer1 and
SMTP antivirus server, all the stream are clear and can be scanned without
any software update or expensive news dedicated hardware.
Do you thing ktcpvs is the right place to implement such a things ?
(Current version of ktcpvs have overhead but for the moment we do not have
many connections to deal with)
Best regards,
Alexandre
|
