TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Serversensor host based IDS:
In the ServerSensor manual there was a sample script that had that
functionality, the only thing you needed to add is user verification. Here
you can use the GetData to extract the username that did the change and
compare it with your authorized list.
SecureLogic is tcl so there is a lot of free sample code on the net and on
some places you'll find tcl tester (interpreter) that can verify your
script.
Included is a pdf helpfile with details on tcl, use also the ServerSensor
manual for the ISS specific extensions (like GetData, SetData,
__iss_priority,..)
If you haven't the manual here is the sample code :
Initialization script:
file copy -force "c:/wwwdir/index.htm" "c:/hidndir/backup.htm"
Validation script:
set fSrc [file size "c:/wwwdir/index.htm"]
set fDest [file size "c:/hidndir/backup.htm"]
if { $fSrc == $fDest } {
# The file has not changed. Do not generate responses.
return 0
} else {
# The file has changed. Generate responses.
return 1
}
Response script:
# replace modified file with original file
file copy -force "c:/hidndir/backup.htm" "c:/wwwdir/index.htm"
Better would also be use md5 hash to verify the change and not only the file
size.
A link to a usefull tcl reference guide
http://www.nmt.edu/tcc/help/lang/tcl/
Hope this can help you on the way.
ir. Kim Apers
-----Original Message-----
From: L Palanio [mailto:[EMAIL PROTECTED]]
Sent: donderdag 14 maart 2002 7:47
To: [EMAIL PROTECTED]
Subject: SecureLogic and monitoring a default webpage
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
Hi, ISS Forum members,
I hope someone can share with me where should I learn SecureLogic for a
start (apart from going for ISS advanced training). I'm not looking for
somebdy to debug my script, rather I need to be sure if the commands and
syntax I use are correct.
My intention is to use SecureLogic to prevent webpage get defaced, and if it
ever get hacked, immediate replacement of a clean one will be inforced.
Having said that, it should only replace if the webpage is changed by
unauthorized users.
Any guidance and feedback is most welcome.
Thank You.
From,
Lawrence Palanio
_________________________________________________________________
Chat with friends online, try MSN Messenger: http://messenger.msn.com
