You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@trafficserver.apache.org by Juan Pablo Daniel <jp...@gmail.com> on 2014/08/20 21:35:46 UTC
Traffic server antivirus plugin?
Hi!
I have ATS as a forward proxy working great and now I want to extend his
tentacles to protect the users.
Is there a "run command on every transferred file" plugin so when a user
start a download it runs a command (the antivirus client) on the file and
then on the result decides if it pass or fails ?
If there is not, I think on a buffered null transform to write the buffer
on a tmp directory, then exec and depending on that produce or cancel and
then send a redirect. What do you think?
Thanks you.
Saludos,
Juan Pablo.
Re: Traffic server antivirus plugin?
Posted by Juan Madrigal <ju...@mac.com>.
Sent from my iPad
On Aug 21, 2014, at 2:00 AM, Nick Kew <ni...@apache.org> wrote:
> On Thu, 2014-08-21 at 02:34 -0300, Juan Pablo Daniel wrote:
>
>> Hello,
>> first thanks you for replying :)
>>
>> Using ironbee will make me add "something else" to my server, and it looks
>> like it's on a very early stage (with "not secure and ready for production"
>> banners and everything) , have you tried this with ATS? is it working well?
>
>
>
> Yes, you should be prepared to be hands-on. But if you're talking about
> a homebrew hack, that's very hands-on too! And yes I've tried it:
> I get paid to hack on it!
>
>
>> Is there any reason why not to do it as a pluguin for ATS?
>> Is anyone working on this?
>
>
> Ironbee runs as a plugin for ATS. Also for other servers/proxies,
> but ATS is its primary platform.
>
>
>> I understand that it's more performant (and possibly richer on features) to
>> do it "over the air" using the AV API, but that ties it to the AV vendor
>> and the code would be so much complex than just tempfile->exec ret?ok:bad;
>> So I think that a generic plugin to run a command on a file transfer can
>> be very useful!
>
>
> Without knowing what your proposed AV looks like, it's hard to offer
> any specific advice. You could make the AV a direct plugin to ATS,
> though that would likely involve re-inventing some of what Ironbee
> provides for you.
>
> --
> Nick Kew
Re: Traffic server antivirus plugin?
Posted by Juan Madrigal <ju...@mac.com>.
Something similar to HAVP?
http://www.server-side.de/features.htm
HAVP works with pfsense if you need a firewall.
-Juan
On Aug 21, 2014, at 2:00 AM, Nick Kew <ni...@apache.org> wrote:
> On Thu, 2014-08-21 at 02:34 -0300, Juan Pablo Daniel wrote:
>
>> Hello,
>> first thanks you for replying :)
>>
>> Using ironbee will make me add "something else" to my server, and it looks
>> like it's on a very early stage (with "not secure and ready for production"
>> banners and everything) , have you tried this with ATS? is it working well?
>
>
>
> Yes, you should be prepared to be hands-on. But if you're talking about
> a homebrew hack, that's very hands-on too! And yes I've tried it:
> I get paid to hack on it!
>
>
>> Is there any reason why not to do it as a pluguin for ATS?
>> Is anyone working on this?
>
>
> Ironbee runs as a plugin for ATS. Also for other servers/proxies,
> but ATS is its primary platform.
>
>
>> I understand that it's more performant (and possibly richer on features) to
>> do it "over the air" using the AV API, but that ties it to the AV vendor
>> and the code would be so much complex than just tempfile->exec ret?ok:bad;
>> So I think that a generic plugin to run a command on a file transfer can
>> be very useful!
>
>
> Without knowing what your proposed AV looks like, it's hard to offer
> any specific advice. You could make the AV a direct plugin to ATS,
> though that would likely involve re-inventing some of what Ironbee
> provides for you.
>
> --
> Nick Kew
Re: Traffic server antivirus plugin?
Posted by Nick Kew <ni...@apache.org>.
On Thu, 2014-08-21 at 02:34 -0300, Juan Pablo Daniel wrote:
> Hello,
> first thanks you for replying :)
>
> Using ironbee will make me add "something else" to my server, and it looks
> like it's on a very early stage (with "not secure and ready for production"
> banners and everything) , have you tried this with ATS? is it working well?
Yes, you should be prepared to be hands-on. But if you're talking about
a homebrew hack, that's very hands-on too! And yes I've tried it:
I get paid to hack on it!
> Is there any reason why not to do it as a pluguin for ATS?
> Is anyone working on this?
Ironbee runs as a plugin for ATS. Also for other servers/proxies,
but ATS is its primary platform.
> I understand that it's more performant (and possibly richer on features) to
> do it "over the air" using the AV API, but that ties it to the AV vendor
> and the code would be so much complex than just tempfile->exec ret?ok:bad;
> So I think that a generic plugin to run a command on a file transfer can
> be very useful!
Without knowing what your proposed AV looks like, it's hard to offer
any specific advice. You could make the AV a direct plugin to ATS,
though that would likely involve re-inventing some of what Ironbee
provides for you.
--
Nick Kew
Re: Traffic server antivirus plugin?
Posted by Juan Pablo Daniel <jp...@gmail.com>.
Hello,
first thanks you for replying :)
Using ironbee will make me add "something else" to my server, and it looks
like it's on a very early stage (with "not secure and ready for production"
banners and everything) , have you tried this with ATS? is it working well?
Is there any reason why not to do it as a pluguin for ATS?
Is anyone working on this?
I understand that it's more performant (and possibly richer on features) to
do it "over the air" using the AV API, but that ties it to the AV vendor
and the code would be so much complex than just tempfile->exec ret?ok:bad;
So I think that a generic plugin to run a command on a file transfer can
be very useful!
Best,
Juan Pablo.
2014-08-20 20:00 GMT-03:00 Nick Kew <ni...@apache.org>:
>
> On 20 Aug 2014, at 22:35, James Peach wrote:
>
> >> Is there a "run command on every transferred file" plugin so when a user
> >> start a download it runs a command (the antivirus client) on the file
> and
> >> then on the result decides if it pass or fails ?
> >
> > Maybe https://www.ironbee.com can do this?
>
> Indeed, ironbee meets that description pretty-much head-on :)
>
> You would still have some work to do to attach your virus scan to ironbee.
>
> >> If there is not, I think on a buffered null transform to write the
> buffer
> >> on a tmp directory, then exec and depending on that produce or cancel
> and
> >> then send a redirect. What do you think?
>
> I should certainly hope you could do it better and more efficiently with
> ironbee.
> At least, assuming there's an API for your proposed virus scanner!
>
> --
> Nick Kew
Re: Traffic server antivirus plugin?
Posted by Nick Kew <ni...@apache.org>.
On 20 Aug 2014, at 22:35, James Peach wrote:
>> Is there a "run command on every transferred file" plugin so when a user
>> start a download it runs a command (the antivirus client) on the file and
>> then on the result decides if it pass or fails ?
>
> Maybe https://www.ironbee.com can do this?
Indeed, ironbee meets that description pretty-much head-on :)
You would still have some work to do to attach your virus scan to ironbee.
>> If there is not, I think on a buffered null transform to write the buffer
>> on a tmp directory, then exec and depending on that produce or cancel and
>> then send a redirect. What do you think?
I should certainly hope you could do it better and more efficiently with ironbee.
At least, assuming there's an API for your proposed virus scanner!
--
Nick Kew
Re: Traffic server antivirus plugin?
Posted by James Peach <jp...@apache.org>.
On Aug 20, 2014, at 12:35 PM, Juan Pablo Daniel <jp...@gmail.com> wrote:
> Hi!
> I have ATS as a forward proxy working great and now I want to extend his
> tentacles to protect the users.
> Is there a "run command on every transferred file" plugin so when a user
> start a download it runs a command (the antivirus client) on the file and
> then on the result decides if it pass or fails ?
Maybe https://www.ironbee.com can do this?
>
> If there is not, I think on a buffered null transform to write the buffer
> on a tmp directory, then exec and depending on that produce or cancel and
> then send a redirect. What do you think?
>
> Thanks you.
>
> Saludos,
> Juan Pablo.