[Rspamd-Users] ICAP still not working

[lutz.niederer at gmx.net]

YES YES YES!!!!

scan_mime_parts = false;

That's it!!!


scan_text_mime = false;
scan_image_mime = false;
...should be set that way when sending the complete mail to the icap scanner?
Means these two are only useful if scan_mime_parts is set to true.  Correct?

Tried with swaks and sent mime messages then it works with scan_mime_parts=true

I thank you VERY MUCH!



> Gesendet: Mittwoch, 17. August 2022 um 12:54 Uhr
> Von: "Carsten Rosenberg" <cr at ncxs.de>
> An: users at lists.rspamd.com
> Betreff: Re: [Rspamd-Users] ICAP still not working
>
> Hey,
>
>
> On 17.08.22 08:18, lutz.niederer at gmx.net wrote:
> > Hi.
> >
> > I started all over again with a fresh and clean install.
> >
> > I am on jammy (22.04), did install the libs from focal (libicu66 & libssl1.1), downloaded & installed the rspamd experimental deb package for focal (3.3-0).  I did enable very verbose operation and let it run.
> >
> > The ICAP server is waiting for connections.  I did verify that the ICAP server really works with c-icap-client and an eicar file.  Everything is fine.
> >
> > Now I sent an email with eicar as body.  The ICAP server was not triggered in any way by rspamd.  It means that the ICAP server was not even tried to be contacted by rspamd.
> >
> > Here comes the config:
> >
> > # local.d/external_services.conf
> > icap {
> >    enabled = true;  #dont't know if this is needed
> >    servers = "127.0.0.1:1344";
> >    user_agent = "agent_coulson";
> >    scheme = "respmod";
> >    x_client_header = true,
> >    x_rcpt_header = true,
> >    x_from_header = true,
> >    symbol = "ICAP_VIRUS";
> >    type = "icap";
> >    scan_mime_parts = true;
> >    scan_text_mime = true;
> >    scan_image_mime = true;
> >    action = "reject";
> >    log_clean = true;
> >    patterns {
> >      # symbol_name = "pattern";
> >      JUST_EICAR = '^Eicar-Test-Signature$';
> >    }
> > }
> > ...
> > I set the ICAP server to 130.0.0.1 and expected some sort of error, but the output was the same (except server=130.0.0.1).
> > I did also install the latest stable version for focal (3.2.1), samesame.
> > So I see that with the latest & experimental versions it does not work.  Because some things seem to load I am unsure if there may be an error in my configuration.
> > Am I right that only adding that snippet to external_services.conf should enable ICAP?  Did I forget something?  Is anything else needed?
> >
> > I thank you very much for any help!
> > -lutzn
> >
> >
>
> your config looks good so far. Please set logging to normal, but
> activate debug logging for the icap module:
>
> #local.d/logging.inc:
> debug_modules=['icap'];
>
> If you use the Eicar string in just in a simple Mail, none of the scan
> options below will be maybe triggered. Try use scan_mime_parts = false
> or use and eicar file as attachment.
>
> Please send us the complete logs of the scan.
>
>
> --
> Carsten
> --
> Users mailing list
> Users at lists.rspamd.com
> https://lists.rspamd.com/mailman/listinfo/users
>