jhardin at impsec
Oct 16, 2009, 6:02 AM
Post #3 of 6
(278 views)
Permalink
|
On Thu, 15 Oct 2009, R-Elists wrote:
> i used to be able to use wget to "easily" download rules from jhardin
> and other sandboxes
>
> now with this new viewvc, it is a total pain in the backside to do
> anything.
>
> how do we make it so it is easy to get the sandbox rules again?
>
> - rh
Karsten beat me to it. Check out what you want using SVN and pull it into
your local config using symlinks or a lint-then-copy script. Keeping
current is a simple matter of "svn up" (plus the processing script, if
you're doing that).
Caveat, though: the sandbox is for testing rules. They may break your
setup, the rule names may change arbitrarily, the rules may disappear
without warning, and scores will probably not be assigned. I strongly
suggest you have a zzz_sandbox_scores.cf file where you assign your own
(conservative) scores to sandbox rules you are pulling into your
production SA.
Unfortunately there's no way to say "turn off all rules in file X except
for Y and Z", which would make using sandbox files in production a little
safer.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin[at]impsec.org FALaholic #11174 pgpk -a jhardin[at]impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Users mistake widespread adoption of Microsoft Office for the
development of a document format standard.
-----------------------------------------------------------------------
15 days since a sunspot last seen - EPA blames CO2 emissions
|
