Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 1 reply
  • Subscribers 1 subscriber
  • Views 7570 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

sssp SCANDIRR request not accepted

gossamer

Hi,

I'm using savdid on fedora20 with amavisd-new and it fails during the scanning process. I'm hoping someone has some ideas of what may be wrong with my configuration to help figure this out.

Here's the output from savdid during the scan of an email:

# bin/savdid -c savdi/savdid.conf -l
SAV Dynamic Interface 2.2.0
Copyright 2000-2013 Sophos Limited. All rights reserved
150301:203747 00034407 Process starting
PID: 20777
150301:203825 [54F3BEEC] 00038400 New connection
To: 0.0.0.0:4010 From 0.0.0.0:4010
150301:203825 [54F3BEEC] 00038402 New session
150301:203825 [54F3BEEC/1] 00030406 Client request
SSSP/1.0 SCANDIRR /var/spool/amavisd/tmp/amavis-20150301T201632-09697-sc8n_oGx/parts
150301:203825 [54F3BEEC] C000460B Client terminated connection early
150301:203825 [54F3BEEC] 00038403 Session ended
150301:203825 [54F3BEEC] 00038401 Connection ended
To: 0.0.0.0:4010 From 0.0.0.0:4010

In the savdid.conf file I have the user and group set as amavis, the same user and group as the amavisd daemon is running.

Amavisd reports the following:

Mar  1 20:38:25 juggernaut amavis[9697]: (09697-08) (!)Sophos-SSSP av-scanner FAILED: run_av error: sssp SCANDIRR request not accepted at (eval 134) line 275.\n

 I have a working clamav installation on this system with amavisd, and it successfully detects my eicar test where sophos fails with the above message.

Is this a permissions problem?

:56037


This thread was automatically locked due to age.
  • 0

    I figured out that the cause of this was DIR (the default) instead of SUBDIR in the allowscanfile section of scanprotocol in savdid.conf. I have no idea why that would be the default.

    If I hadn't found an obscure, unrelated reference to it elsewhere online, it would have taken forever to figure this out.

    :56083