ISPConfig + RSpamd: Scanning password-protected archives with common passwords

Hi all,
I'm running ISPConfig 3.3.1 with Postfix, Dovecot, and RSpamd on Ubuntu 24.
Currently I have the following setup working:
- RSpamd detects password-protected archives via MIME_ENCRYPTED_ARCHIVE symbol (score = 15.0)
- Sieve rule redirects emails with X-Spam-Status: Yes and X-Spam-Score >= 15 to admin quarantine mailbox
- ClamAV is integrated for antivirus scanning via clamd socket
The current setup works well — password-protected archives are detected and sent to quarantine. However, I would like to go one step further and actually scan the contents of password-protected archives by trying a list of common passwords (such as "123", "infected", "virus", "password", etc.), and then pass the extracted contents to ClamAV for scanning.
I tried creating /etc/rspamd/local.d/archive.conf with the following:
enabled = true; max_size = 50M; passwords = [ "123", "1234", "12345", "1", "qwerty", "password", "infected", "virus" ];
However, this does not seem to have any effect.
My questions:
1. Does ISPConfig's RSpamd integration support scanning password-protected archives using a predefined list of common passwords?
2. If yes, what is the correct configuration?
3. Is there any recommended solution or workaround within the ISPConfig ecosystem to achieve this?
For reference, my current working quarantine setup:
- /etc/rspamd/local.d/groups.conf: MIME_ENCRYPTED_ARCHIVE score = 15.0
- /var/lib/dovecot/sieve/quarantine.sieve: redirects spam with score >= 15 to admin mailbox
- /etc/dovecot/dovecot.conf: sieve_before = /var/lib/dovecot/sieve/quarantine.sieve
Any advice would be greatly appreciated! Server info: - OS: Ubuntu 24 - ISPConfig: 3.3.1 - RSpamd: 3.x - Postfix + Dovecot + ClamAV
Thank you!

 

I am not aware of a module named "archive" in rspamd. Where did you get that config from?

The only possible solution that comes to mind would be using exernal_services.conf and something like https://github.com/DanielWidmayer/mail-attac

Allthough I think the idea itself is not a good one. Just outrigth reject these files and go on with your day.