<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Jetzt habe ich sogar<div class=""><br class=""></div><div class=""><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Menlo; color: rgb(211, 115, 38); background-color: rgb(25, 25, 25);" class=""><span style="font-variant-ligatures: no-common-ligatures; color: #66ff66" class=""> </span><span style="font-variant-ligatures: no-common-ligatures" class="">savdi_report_encrypted</span><span style="font-variant-ligatures: no-common-ligatures; color: #66ff66" class=""> = false;</span></div><div class=""><span style="font-variant-ligatures: no-common-ligatures; color: #66ff66" class=""><br class=""></span></div><div>Gesetzt, und es erscheint immer noch im Log:</div><div><br class=""></div><div><br class=""></div><div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Menlo; color: rgb(102, 255, 102); background-color: rgb(25, 25, 25);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Nov 19 13:55:41 smtp1 rspamd[16640]: <92fd52>; lua; </span><span style="font-variant-ligatures: no-common-ligatures; color: #f79e96" class=""><b class="">sophos</b></span><span style="font-variant-ligatures: no-common-ligatures" class="">.lua:143: Message is encrypted (FAIL 0212): FAIL 0212 \0d\0a</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Menlo; color: rgb(102, 255, 102); background-color: rgb(25, 25, 25);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Nov 19 13:55:41 smtp1 rspamd[16640]: <92fd52>; lua; common.lua:108: </span><span style="font-variant-ligatures: no-common-ligatures; color: #f79e96" class=""><b class="">sophos</b></span><span style="font-variant-ligatures: no-common-ligatures" class="">: result - FAILED with error: "SAVDI: Message is encrypted (FAIL 0212) - score: 0"</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Menlo; color: rgb(102, 255, 102); background-color: rgb(25, 25, 25);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Nov 19 13:56:13 smtp1 rspamd[16642]: <0a5ed6>; lua; common.lua:108: </span><span style="font-variant-ligatures: no-common-ligatures; color: #f79e96" class=""><b class="">sophos</b></span><span style="font-variant-ligatures: no-common-ligatures" class="">: result - Scan has returned that input was encrypted: "File is encrypted - score: 1"</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Menlo; color: rgb(102, 255, 102); background-color: rgb(25, 25, 25);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Nov 19 13:56:13 smtp1 rspamd[16642]: <0a5ed6>; proxy; rspamd_add_passthrough_result: <<a href="mailto:a4d0b34486cc4669b1cb50050f4957df@beermann-partner.de" class="">a4d0b34486cc4669b1cb50050f4957df@beermann-partner.de</a>>: set pre-result to 'reject' (no score): 'VEKA </span><span style="font-variant-ligatures: no-common-ligatures; color: #f79e96" class=""><b class="">sophos</b></span><span style="font-variant-ligatures: no-common-ligatures" class="">: virus found: "File is encrypted"' from </span><span style="font-variant-ligatures: no-common-ligatures; color: #f79e96" class=""><b class="">sophos</b></span><span style="font-variant-ligatures: no-common-ligatures" class="">(1)</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Menlo; color: rgb(102, 255, 102); background-color: rgb(25, 25, 25);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Nov 19 13:56:17 smtp1 postfix/cleanup[6470]: 6157A8C1D: milter-reject: END-OF-MESSAGE from <a href="http://idvmailout01.datevnet.de" class="">idvmailout01.datevnet.de</a>[193.27.50.76]: 5.7.1 VEKA </span><span style="font-variant-ligatures: no-common-ligatures; color: #f79e96" class=""><b class="">sophos</b></span><span style="font-variant-ligatures: no-common-ligatures" class="">: virus found: "File is encrypted"; from=<<a href="mailto:Audit@beermann-partner.de" class="">Audit@beermann-partner.de</a>> to=<<a href="mailto:csach@veka.com" class="">csach@veka.com</a>> proto=ESMTP helo=<<a href="http://idvmailout01.datevnet.de" class="">idvmailout01.datevnet.de</a>></span></div></div><div><br class=""></div><div><br class=""></div><div><br class=""></div><div>WTF?</div><div><br class=""></div><div><br class=""><blockquote type="cite" class=""><div class="">Am 19.11.2019 um 13:33 schrieb Frank Fiene <<a href="mailto:ffiene@veka.com" class="">ffiene@veka.com</a>>:</div><br class="Apple-interchange-newline"><div class=""><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br class="Apple-interchange-newline"><br class=""><blockquote type="cite" class=""><div class="">Am 19.11.2019 um 12:46 schrieb Carsten Rosenberg <<a href="mailto:cr@ncxs.de" class="">cr@ncxs.de</a>>:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hey,<br class=""><br class="">es gab noch nen fix wegen der Upstreams. Ich weiß grad leider nicht ob<br class="">das im 2.1 Release schon drin war.<br class=""><br class="">Pack mal antivirus in die debug_modules, ob Rspamd da mehr sagt. Und<br class="">schau mal ins savdi log.<br class=""></div></div></blockquote><div class=""><br class=""></div><div class="">Wenn ich in debug_modules das antivirus einschalte, sehe ich , dass rspamd mit dem savdi korrekt kommuniziert. Der erkennt ja auch manchmal Viren.</div><div class=""><br class=""></div><div class="">Das savdi log selber sieht gut aus, wenn da manchmal steht, dass der Client die Verbindung „early“ beendet hat, heißt das wahrscheinlich, dass rspamd anderweitig schon die Entscheidung getroffen hat, die Mail abzuweisen, oder?</div><div class=""><br class=""></div><br class=""><blockquote type="cite" class=""><div class=""><div class="">Wegen der max Connections:<br class=""><a href="https://gist.github.com/c-rosenberg/671b0a5d8b1b5a937e3e161f8515c666" class="">https://gist.github.com/c-rosenberg/671b0a5d8b1b5a937e3e161f8515c666</a><br class="">Vielleicht muss du da noch was drehen.<br class=""></div></div></blockquote><div class=""><br class=""></div><div class="">Da stand vorher </div><div class=""><br class=""></div><div class="">threadcount = 30</div><div class="">maxquedsessions=20</div><div class=""><br class=""></div><div class="">Ich habe den Wert der maxquedsessions auf 2 gesetzt.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Kann ich den ersten Wert hochstehen, wenn das System das Ressourcentechnisch erlaubt?</div><div class=""><br class=""></div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><blockquote type="cite" class=""> scan_mime_parts = true;<br class=""> scan_text_mime = true;<br class=""> scan_image_mime = true;<br class=""> symbol = "SOPHOS_VIRUS";<br class=""></blockquote><br class="">Das erzeugt natürlich auch viele Requests.<br class=""></div></div></blockquote><div class=""><br class=""></div><div class="">Was ist deine Empfehlung?</div><div class=""><br class=""></div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><blockquote type="cite" class="">SOPHOS_VIRUS_ENCRYPTED (0) [File is encrypted]<br class=""></blockquote><br class="">Das ist das neue generische Symbol für verschlüsselte Files. Da musst du<br class="">deine Settings anpassen.<br class=""><br class="">Viele Grüße<br class=""><br class="">Carsten<br class=""><br class=""><br class="">On 19.11.19 12:39, Ralf Hildebrandt wrote:<br class=""><blockquote type="cite" class="">* Frank Fiene <<a href="mailto:ffiene@veka.com" class="">ffiene@veka.com</a>>:<br class=""><blockquote type="cite" class="">Seit etwas mehr als zwei Wochen:<br class=""><br class="">/var/log/mail.log:835<br class="">/var/log/mail.log.1:2347<br class="">/var/log/mail.log.2:1792<br class="">/var/log/mail.log.3:22<br class="">/var/log/mail.log.4:27<br class=""></blockquote><br class="">Mein Setup:<br class=""><br class=""> action = "reject";<br class=""><br class=""> scan_mime_parts = true;<br class=""> scan_text_mime = true;<br class=""> scan_image_mime = true;<br class=""> symbol = "SOPHOS_VIRUS";<br class=""><br class=""> type = "sophos";<br class=""><br class=""> log_clean = false;<br class=""> timeout = 30.0;<br class=""> retransmits = 4;<br class=""><br class=""> servers = "127.0.0.1:4010";<br class=""><br class=""></blockquote></div></div></blockquote></div><br class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div dir="auto" class="" style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div class="" style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div class="" style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div class="" style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div class="" style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div class="" style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div class="" style="font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div class="" style="font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Viele Grüße!<br class="">i.A. Frank Fiene<br class="">-- <br class="">Frank Fiene</div><div class="" style="font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">IT-Security Manager VEKA Group</div><div class="" style="font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><br class="">Fon: +49 2526 29-6200<br class="">Fax: +49 2526 29-16-6200<br class="">mailto: <a href="mailto:ffiene@veka.com" class="">ffiene@veka.com</a><br class=""><a href="http://www.veka.com/" class="">http://www.veka.com</a><br class=""><br class=""></div><div class="" style="font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">PGP-ID: 62112A51<br class="">PGP-Fingerprint: 7E12 D61B 40F0 212D 5A55 765D 2A3B B29B 6211 2A51</div><div class="" style="font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Threema: VZK5NDWW<br class=""><br class="">VEKA AG<br class="">Dieselstr. 8<br class="">48324 Sendenhorst<br class="">Deutschland/Germany<br class=""><br class="">Vorstand/Executive Board: Andreas Hartleif (Vorsitzender/CEO),<br class="">Dr. Andreas W. Hillebrand, Bonifatius Eichwald, Elke Hartleif, Dr. Werner Schuler,<br class="">Vorsitzender des Aufsichtsrates/Chairman of Supervisory Board: Ulrich Weimer<br class="">HRB 8282 AG Münster/District Court of Münster</div></div></div></div></div></div></div></div></div></div></blockquote></div><br class=""><div class="">
<div dir="auto" style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Viele Grüße!<br class="">i.A. Frank Fiene<br class="">-- <br class="">Frank Fiene</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">IT-Security Manager VEKA Group</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class="">Fon: +49 2526 29-6200<br class="">Fax: +49 2526 29-16-6200<br class="">mailto: <a href="mailto:ffiene@veka.com" class="">ffiene@veka.com</a><br class=""><a href="http://www.veka.com" class="">http://www.veka.com</a><br class=""><br class=""></div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">PGP-ID: 62112A51<br class="">PGP-Fingerprint: 7E12 D61B 40F0 212D 5A55 765D 2A3B B29B 6211 2A51</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Threema: VZK5NDWW<br class=""><br class="">VEKA AG<br class="">Dieselstr. 8<br class="">48324 Sendenhorst<br class="">Deutschland/Germany<br class=""><br class="">Vorstand/Executive Board: Andreas Hartleif (Vorsitzender/CEO),<br class="">Dr. Andreas W. Hillebrand, Bonifatius Eichwald, Elke Hartleif, Dr. Werner Schuler,<br class="">Vorsitzender des Aufsichtsrates/Chairman of Supervisory Board: Ulrich Weimer<br class="">HRB 8282 AG Münster/District Court of Münster</div></div></div></div></div></div></div></div>
</div>
<br class=""></div></body></html>