[Rspamd-Users] Doubt on Antivirus settings

[Carsten Rosenberg]

Every mail is being scanned, when there is no cached result.

The only question is, will the complete mail or only parts (maybe
attachments like .exe, .docx, .iso)..


Set

scan_mime_parts = false;

or scan just non-text, non-image parts

>> scan_mime_parts = true;
>> scan_text_mime = false;
>> scan_image_mime = false;

when you have a default ClamAV, Sophos or Avira. This setting would also
scan your .iso



Currently the only benefit for enabling all options

> scan_mime_parts = true;
> scan_text_mime = true;
> scan_image_mime = true;

is when you use additional unofficial ClamAV sigs like Sanesecurity or
SecuriteInfo

Carsten



On 09.11.18 15:31, Thomas Plant via Users wrote:
> Thanks, for the answer.
> 
> So, for a better understanding, if I set:
> 
> scan_mime_parts = true;
> scan_text_mime = true;
> scan_image_mime = true;
> 
> also all incoming mails are scanned?
> 
> 
> Am 09.11.2018 um 15:12 schrieb Carsten Rosenberg:
>> With scan_mime_parts = false; you tell rspamd to scan the complete mail.
>>
>> scan_text_mime = true; -> this setting is unused when scanning the
>> complete mail.
>>
>> -- 
>>
>> Some examples:
>>
>> scan_mime_parts = true;
>> scan_text_mime = false;
>> scan_image_mime = false;
>>
>> -> Scan mime parts separately, but so not scan Text or Image Parts.
>>
>> -- 
>>
>> scan_mime_parts = true;
>> scan_text_mime = true;
>> scan_image_mime = true;
>>
>> -> Scan mime parts separately and also scan Text and Image parts.
>>
>> -- 
>>
>> So your mail should have been scanned with your settings.
>>
>> Carsten
>>
>>
>> On 09.11.18 14:32, Thomas Plant via Users wrote:
>>> Hello,
>>>
>>> maybe it is because it's friday and my mind is a litte tired but I have
>>> a problem of understanding these settings:
>>>
>>>    scan_mime_parts = false;
>>>    scan_text_mime = true;
>>>
>>> made this way, will cause every mail to be scanned by the antivirus? Or
>>> do exist other criteria when to scan an incoming mail?
>>>
>>> This is because I had a mail with an '.iso' file attached which has not
>>> been scanned by the antivirus. And it did not match the max_size setting
>>> in AV-module, it was way less than the 10 Mbytes I had setted as a
>>> limit.
>>>
>>> Sincerely,
>>> Thomas
>