[Rspamd-Users] Kaspersky as External Service

Carsten Rosenberg cr at ncxs.de
Sun Jul 28 19:17:01 UTC 2019


I had a trial of their latest Web Security as mentioned in the docs.

I'm currently on vacation, but will check this installation afterwards.

Carsten. 

Am 27. Juli 2019 18:52:12 MESZ schrieb Rob Gunther <redrob at gmail.com>:
>Carsten, what platform was your test install of Kaspersky Web Traffic
>Security 6.0 on?  I can't find any way to enable those headers.  I even
>checked with Kaspersky support who claim it is not possible.
>
>On Wed, Jul 24, 2019 at 8:16 PM Carsten Rosenberg <cr at ncxs.de> wrote:
>
>> Hi,
>>
>> currently we are only analyzing the ICAP Response headers, but not
>the
>> RESPMOD headers.
>>
>> I have tried Kaspersky Web Traffic Security 6.0. This version had the
>> Following ICAP response headers:
>>
>>   X-Virus-ID: HEUR:Backdoor.Java.QRat.gen
>>   X-Response-Info: blocked
>>
>> Maybe you can enable those somehow or there's another URL with more
>> options.
>>
>> --
>> Carsten
>>
>> On 24.07.19 11:31, Rob Gunther wrote:
>> > I am trying to setup scanning against Kaspersky, as an external
>ICAP
>> > service.  Using RSPAMD v1.9.4
>> >
>> > I can see RSPAMD is sending messages to the ICAP service and I can
>see
>> > Kaspersky scanning them.  Kaspersky IS identifying the messages as
>> infected
>> > but the logs on RSPAMD always say the message was reported clean
>like
>> this:
>> >
>> > 2019-07-24 08:59:35 #4135(controller) <f2c8be>; lua; common.lua:36:
>> > kaspersky_icap (icap): message or mime_part is clean
>> >
>> > What is RSPAMD looking for in the return?
>> >
>> > I tested the connection to the ICAP service, from the RSPAMD server
>to
>> > simulate what may be going on, using an icap-client and here is
>what that
>> > returns when the same infected file is sent in:
>> >
>> > ----------
>> > c-icap-client -v -i 192.168.60.128 -p 1344 -s av/reqmod -f
>/tmp/virus.eml
>> > -d 9
>> > ICAP server:192.168.60.128, ip:192.168.48.45, port:1344
>> >
>> > Allocate a new entity of type 1
>> > Allocate a new entity of type 3
>> > Going to add 4 response headers
>> > Add resp header: HTTP/1.0 200 OK
>> > Add resp header: Date: Wed Jul 24 09:29:19 2019
>> > Add resp header: Last-Modified: Wed Jul 24 09:29:19 2019
>> > Add resp header: Content-Length: 18605
>> > Preview response was with status: 100
>> > Response was with status:200
>> > Get entity from trash....
>> > Get entity from trash....
>> > OK reading headers, going to read body
>> > <!DOCTYPE html>
>> > <html>
>> >     <head>
>> >         <meta charset="utf-8">
>> >         <title>Access Denied by Kaspersky Web Traffic
>Security</title>
>> >         <style rel="stylesheet" data-href="style.css">
>> >             html { font-family: sans-serif; font-size: 13px;
>min-height:
>> > 480px; min-width: 640px; }
>> >             body { margin: 0; text-align: center; }
>> >             .header { position: absolute; top: 0; left: 0; right:
>0;
>> > height: 36px; line-height: 36px; vertical-align: middle;
>> background-color:
>> > #d74747; color: #ffffff; }
>> >             .content-wrap { position: absolute; top: 36px; left: 0;
>> right:
>> > 0; bottom: 0; margin-left: 63.5px; margin-right: 63.5px; }
>> >             .application { position: absolute; top: 0; height: 30%;
>left:
>> > 0; right: 0; }
>> >             .application h1 { position: absolute; bottom: 0; left:
>0;
>> > right: 0; font-size: 19px; vertical-align: bottom; font-weight:
>normal; }
>> >             .content { position: absolute; height: 70%; bottom: 0;
>left:
>> 0;
>> > right: 0; }
>> >             .text-macro a, .text-macro a:visited, .text-macro
>a:active {
>> > color: #006d5c; text-decoration: none; }
>> >             .description { position: absolute; top: 30%; left: 0;
>right:
>> 0;
>> > }
>> >             .rule, .date { margin: 5px 0; }
>> >             .date { margin-bottom: 10px; }
>> >             .footer { color: #999999; position: absolute; bottom:
>0;
>> left:
>> > 0; right: 0; }
>> >         </style>
>> >     </head>
>> >     <body>
>> >         <div class="header">Access denied</div>
>> >         <div class="content-wrap">
>> >             <div class="application"><h1>Kaspersky Web Traffic
>> > Security</h1></div>
>> >             <div class="content"><div class="text-macro">
>> >     <p>The requested page cannot be provided</p>
>> >     <p>Address: <a></a></p>
>> >     <p class="description">The web resource is prohibited at the
>company.
>> > If you consider
>> >     the blocking to be mistaken or if you need to access this web
>> resource,
>> >     contact the administrator of the local corporate network.</p>
>> > </div>
>> >
>> > <div class="footer">
>> >     <p class="rule">Default Protection Rule</p>
>> >     <p class="date">2019-Jul-24 05:29:20 (GMT 2019-Jul-24
>09:29:20)</p>
>> > </div>
>> > </div>
>> >         </div>
>> >     </body>
>> > </html>
>> >
>> > ICAP HEADERS:
>> >         ICAP/1.0 200 OK
>> >         ISTag: "KWTS_2019-07-24_09"
>> >         Date: Wed, 24 Jul 2019 09:29:20 GMT
>> >         Server: KAV-ICAP-Server/8.0
>> >         X-ICAP-msg-id: x6O9TK185
>> >         Encapsulated: res-hdr=0, res-body=73
>> >
>> > RESPMOD HEADERS:
>> >         HTTP/1.1 403 Forbidden
>> >         Content-Type: text/html
>> >         Content-Length: 2114
>> >
>> > Done
>> > ----------
>> >
>> >
>> > So things seem to be working, but the reply that RSPAMD is getting
>is not
>> > something that it is identifying as an infection.
>> >
>> >
>> > Any ideas?
>> >
>> --
>> Users mailing list
>> Users at lists.rspamd.com
>> https://lists.rspamd.com/mailman/listinfo/users
>>


More information about the Users mailing list