Update: Based on an email I received, I've updated this post with more relevant information regarding setting up SAVDI with amavisd-new.
I recently migrated to using Postfix with amavisd-new on Ubuntu Linux, and was looking at integrating Sophos AntiVirus with amavisd-new. amavisd-new shipping with the LTS release of Ubuntu is 2.6.5, which does not include SPPP functionality for communicating with savdi so you must use Sophie protocol.
The following components were used for setting up this functionality with amavisd-new from MySophos Download & Updates:
- Sophos Anti-Virus for Linux v9.1
- SAV Dynamic Interface 2.2 Linux 32-bit
This post is assuming that you have setup amavisd-new on your system, and have it integrated with Postfix or equivalent MTA already.
savdid.conf:
channel {
commprotocol {
type: UNIX
socket: /var/run/savdid/savdid.sock
user: amavis
group: amavis
requesttimeout: 120
sendtimeout: 2
recvtimeout: 5
}scanprotocol {
type: SOPHIE
allowscandir: SUBDIR
maxscandata: 500000
maxmemorysize: 250000
tmpfilestub: /tmp/savid_tmp
}scanner {
type: SAVI
inprocess: YES
maxscantime: 3
maxrequesttime: 10
deny: /dev
deny: /home
savigrp: GrpArchiveUnpack 0
savigrp: GrpInternet 1
savists: Xml 1
}
}
This should permit amavisd-new to communicate with the SAVDID interface. Don't forget to create the appropriate init.d script to start savdid on boot and make sure to create the /var/run/savdid directory – as Debian/Ubuntu clean /var/run on system startup. Please download the init script from here and place it in /etc/init.d/savdid with an executable bit.
amavis communicates with SAVI using the Sophie protocol, to enable this support in amavis-new edit /etc/amavis/conf.d/15-av_scanners and add the following lines:
['Sophie',
\&ask_daemon, ["{}/\n", '/var/run/savdid/savdid.sock'],
qr/(?x)^ 0+ ( : | [\000\r\n]* $)/m, qr/(?x)^ 1 ( : | [\000\r\n]* $)/m,
qr/(?x)^ [-+]? \d+ : (.*?) [\000\r\n]* $/m ],
Please be aware that the socket line is being pointed at the place where we have SAVI listening for connections, based on our previous post.