<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div><blockquote type="cite" class=""><div class=""><div style="white-space: pre-wrap; caret-color: rgb(0, 0, 0); font-family: "DejaVu Sans"; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px;" class="">Am Montag, 29. März 2021, 10:30:58 CEST schrieb André Peters:</div><div style="white-space: pre-wrap; caret-color: rgb(0, 0, 0); font-family: "DejaVu Sans"; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px;" class="">> Das ist richtig, schau dir bitte mal die Rspamd Logs an. :) Welche Symbole</div><div style="white-space: pre-wrap; caret-color: rgb(0, 0, 0); font-family: "DejaVu Sans"; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px;" class="">> hat er für die Mail hinzugefügt?</div><p style="white-space: pre-wrap; caret-color: rgb(0, 0, 0); font-family: "DejaVu Sans"; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px;" class=""> </p><div style="white-space: pre-wrap; caret-color: rgb(0, 0, 0); font-family: "DejaVu Sans"; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px;" class="">Das ist der Log, wenn ich eine Eicar-Testmail sende:</div></div></blockquote><br class=""></div><div>Schick Dir selbst eine Mail und schreibe nur den Eicar-Teststring hinein:</div><div><br class=""></div><div><a href="https://www.eicar.org/?page_id=3950" class="">https://www.eicar.org/?page_id=3950</a></div><div>Abschnitt "The Anti-Malware Testfile", der String, der mit X5O... anfängt.</div><div><br class=""></div><div>Falls das erkannt wird füge in local.d/antivirus.conf folgende Optionen</div><div>hinzu und starte rspamd neu:</div><div><br class=""></div><div>clamav {</div><div> ...</div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class=""> </span><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">scan_mime_parts = true;</span><br style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class=""></div><div> scan_text_mime = true;<br class=""> scan_image_mime = true;<br class=""> retransmits = 4;<br class=""> timeout = 15;<br class=""> ...</div><div>}</div><div><br class=""></div><div>Schau auch im Systemlog ob clamav selbst Eicar erkennt.</div><div><br class=""></div><div><br class=""></div><div>Alternativ prüfe die clamd.conf (von clamav, nicht von rspamd):</div><div><br class=""></div><div>ScanMail BOOL<br class=""> Enable scanning of mail files.<br class=""> If you turn off this option, the original files will still be scanned, but without parsing individual messages/attachments.<br class=""> Default: yes</div><br class=""><div class="">Siehe man clamd.conf</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Viele Grüße</div><div class="">Gerald</div></body></html>