I wrote this perl script a while back ..
#!/usr/bin/perl
# Matthew F. Caldwell,CISSP
# GuardedNet, Inc.
# [EMAIL PROTECTED]
# Home of NeuSecure: Security Analyst Workbench
# 2000(c)
#Use at your own risk.
# To enable all try
#usage: ./script.pl current.policy enable > new.policy
# To disable
#usage: ./script.pl current.policy > new.policy
open ( POLICY, $ARGV[0] ) or die "Error opening '$ARGV[0]': $!\n";
$count = 0;
while(<POLICY>) {
$policyarray[$count] = $_;
$count++;
}
for($i = 0;$i < $count;$i++) {
if($policyarray[$i - 1] =~ /Response\\RSKILL/ ) {
if($ARGV[1] =~ /enable/ ) {
print "Enabled =B 1\;\n";
}
else {
print "Enabled =B 0\;\n";
}
} else
{ print "$policyarray[$i]"; }
}
-----Original Message-----
From: [EMAIL PROTECTED]
Sent: Mon 11/12/2001 9:59 AM
To: [EMAIL PROTECTED]
Cc:
Subject: Removing RSKill from Policy files
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your
message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with
any problems!
------------------------------------------------------------------------
----
Does anyone know of a script or method of removing the RSKill
option
from all signatures within a policy file? I have a policy file
(Network
sensor 5.0) that has the RSKill option active on multiple
signatures. I
need to disable the RSKill on all signatures within this policy
file and
the only way I've found so far is the GUI screen and selecting
each
individual signature and disabling RSKill. As there are several
hundred
signatures that would need to be changed and I have multiple
policy
files to update I need a faster method. The policy files appear
to be
flat text files and I believe a script could modify all
signatures.
I've spoken with ISS Support and they don't have a script or
know of
another method outside of the GUI interface.
Thanks,
David T. Sczepanski
Central Operations Security
Lockheed Martin Technology Services Group
(919)541-4815
<<winmail.dat>>
