encrypted archives still coming through

[stuasch]

hey all so i setup avast instead of clamav due to clamav not being 100% with scanning files. today we received numerous mails with a .zip with a password in it. however in my settings i have set that it should block encrypted zip files, in my /etc/pmg/pmg.conf i also see this setting but the mails are coming through.
what can i do about this?

 

[Stoiko Ivanov]

please paste the logs of such a mail

if you configure 'Block encrypted archives and documents' this results in ClamAV triggering a Heuristic, which in turn gets treated as a spam-hit and adds a number of points to the spam-score, which you can configure in GUI->Configuration->Spam Detector->Options->Heuristic Score

Just set this number to a high value and create an appropriate rule quarantining or blocking mails with a high score

I hope this helps!

 

[stuasch]

hi thanks for the reply going to test that! much appreciated for the feedback!

 

[Stefano Giunchi]

I just hit this problem too. I think, as a suggestion, that the "Block encrypted archives and documents" really blocks it, the Heuristic Score thing is not very intuitive.
Thanks.

 

[ittk]

Yes, maybe an simple rename would be more intuitive

 

[Stoiko Ivanov]

I think, as a suggestion, that the "Block encrypted archives and documents" really blocks it, the Heuristic Score thing is not very intuitive.

It does cause some confusion initially (hence the hint in the reference documentation:
https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmgconfig_clamav )

I am open to renaming this (at least in the GUI - since a change in the config-file would be a bit more involved, as to not break backward compatibility

Any suggestions for a better sounding phrasing?

 

[ittk]

It does cause some confusion initially (hence the hint in the reference documentation:
https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmgconfig_clamav )

I am open to renaming this (at least in the GUI - since a change in the config-file would be a bit more involved, as to not break backward compatibility

Any suggestions for a better sounding phrasing?

My usgesstion is: "Add Spam Score for encrypted archives and documents"

 

[Stoiko Ivanov]

"Add Spam Score for encrypted archives and documents"

does not quite describe it IMHO: the spamscore is configurable and only added if it is set in the Spam Detector Options...

 

[ittk]

does not quite describe it IMHO: the spamscore is configurable and only added if it is set in the Spam Detector Options...

Heutrisic Score better? but its added to the SA Score...