Block encrypted Files via AVL Basic / SAVDI

Question

Hello, 
 
 I have an private E-Mail Server with Rspamd and I have also installed there Antivus for Linux Free and I'd like to block encrypted Files there which can't be scanned. The setup is, that Postfix will receive the Mail and send it to Rspamd and Rspamd will forward it to SAVDI to check if the attachments will contain an virus. It looks like, that Rsamd can only SSSP because when I set it to use the ICAP TCP Socket then it sends an SSSP Request. Is there any possiblity to block encrypted files with the SSSP Protcol? 
 
 Thanks for your help. 
 
 Regards.

QC · Accepted Answer

Hello Matthias Mandlmeier , 
 as said, I'm afraid I don't have any experience with either so I can't say what could be wrong.. 
 The part of the log you showed contains just a single session, and as far as I can see no client requests - perhaps add logrequests: YES in the scanprotocol configuration. Client terminated connection early doesn't seem right - do you get it for all requests? If logrequests doesn't give an insight I'd suggest Wireshark to monitor the sessions - while there is no dissector for SSSP Line-based text data should do. 
 Christian

QC · Answer

Hello Matthias, 
 I'm not sure what SAVDI expects in SCANDATA but I think it basically works like the on-access scanner scanning a file. In particular AFAIK it doesn't go any lengths do dissect and decode (complex) containers. An encrypted .zip isn't significantly larger than an unencrypted one but the SCANDATA request shows a size of 22871. 
 Christian

matthias · Answer

Hello Christian, 
 I have now installed Amavis on my Mailserver and Postfix also send the attachments to this Deamon and there I got more Output from the Log of Sophos likes this with an encrypted ZIP File for example. 
 amavis[17668]: (17668-11) (!)do_unzip: p003, unsupported compression method: 99 
 amavis[17668]: (17668-11) (!)run_av (Sophos-SSSP) FAILED - unexpected , output="FAIL 0212 /var/lib/amavis/tmp/amavis-20171126T234709-17668-DpgG67vk/parts/p007
FAIL 0212 /var/lib/amavis/tmp/amavis-20171126T234709-17668-DpgG67vk/parts/p003
DONE FAIL 0212 File was encrypted
" 
 amavis[17668]: (17668-11) (!)Sophos-SSSP av-scanner FAILED: CODE(0x339f658) unexpected , output="FAIL 0212 /var/lib/amavis/tmp/amavis-20171126T234709-17668-DpgG67vk/parts/p007
FAIL 0212 /var/lib/amavis/tmp/amavis-20171126T234709-17668-DpgG67vk/parts/p003
DONE FAIL 0212 File was encrypted
" at (eval 96) line 905. 
 I configured then Amavis, that it should reject the encrypted Files and it also send out an E-Mail to the Sender that this Content is blocked. 
 I think it could be that the Protocol between Rspamd and SAVDI doesn't support encrypted Files or the Protocol is very basic and it can detect only viruses. 
 My Setup is now that Postfix will receive the message and sent it to Rspamd to and see if the Mail is SPAM or it contains an Virus and rejects it. If Rspamd doesn't detect it is an encrypted File or maybe the Virus isn't detect then it will be forwarded to Amavis to check it again if the File is maybe encrypted and the File will be checked again with Sophos. 
 This is maybe only an workaround but it is enough for me, because it is only an private mailserver and it has no business use. 
 Thanks for your help Christian. 
 Regards 
 Matthias