I have also noticed that many times emails with office attachments containing viruses pass the rspamd/oletools filter with the same error.
I have “solved” by rejecting all office documents and sending an email reply to send the documents or compressed or deposit them on the corporate NextCloud
I did not do it on Nethserver but with a script on “hmailserver mail server” interposed in the mail flow.
No matter what the file contains, if it is an office document it is rejected in any case with an email warning both to the sender and to the recipient, unless the sender or the sender’s domain is in whitelist.
It is time to start educating people not to send office documents as email attachments without compressing them or turning them into PDFs.
If it were up to me the emails would still be in pure text format without attachments…
I found @stephdl ever post in this link https://github.com/rspamd/rspamd/issues/2899 Expected behavior
When you use a TCP socket, Rspamd expects that the service could not be reachable, then if the Clamd service does not answer, the SYMBOL CLAM_VIRUS_FAIL is added (this symbol can be used to do a force_action after). But when Rspamd cannot connect to the Unix socket of Clamd, apart a maillog warning, nothing is done.
We would like to make a soft reject of emails if Rspamd cannot contact Clamd, this is our security mail policy.
The simple workaround is to use now a TCP socket with Clamd, but we wonder if it is not an issue to fix, for example if Postfix cannot use the Unix socket of Rspamd, the policy is to soft reject all received emails.
Any help appreciated,
I’m using
NethServer release 7.8.2003 (final)
rspamd 2.2
ClamAV 1.5.1
Below is rspamd.conf
[root@mail ~]# cat /etc/clamd.d/rspamd.conf
# Use system logger.
LogSyslog yes
# Specify the type of syslog messages - please refer to 'man syslog'
# for facility names.
LogFacility LOG_MAIL
# This option allows you to save a process identifier of the listening
# daemon (main thread).
PidFile /var/run/clamd@rspamd/clamav.pid
# Remove stale socket after unclean shutdown.
# Default: disabled
FixStaleSocket yes
# Run as a selected user (clamd must be started by root).
User _rspamd
# Path to a local socket file the daemon will listen on.
LocalSocket /var/run/clamd@rspamd/clamav
#restrict permission
LocalSocketMode 770
Sorry I do not understand the issue, IIRC when the clamav socket is not available then we already softreject the email, except if the sender is know on the server (EG, a user is using the server smtp to send an email)
