[Snort-users] rules update

Jason Haar Jason.Haar at ...294...
Wed Nov 21 12:33:07 EST 2001


On Tue, Nov 20, 2001 at 11:31:08AM -0500, Matt Kettler wrote:
> Still it is not likely a good idea to automatically update from a cron job 
> for the other reasons (purposeful or accidental check-in dysfunctional 
> rules, etc).
> ... 
> Perhaps I'm off-base, but it does strike me as a bad idea to automatically 
> pull rules updates from CVS. Although I do agree with the idea of using cvs 
> update to pull out the latest rules manually with minimal headaches.
> 
> Anyone have any more insightful comments on that issue than I can provide?

I agree entirely. I have asked for ages that all rules be PGP signed - at
least then you'd know if they'd been dicked with!

Anyway, what I do here is cron-pull down the rules every day, and diff them
against the "live set". Any changes are Email'ed to me. Then I can view the
changes, and if they look OK, do a "scriptname -live" to move them live.


-- 
Cheers

Jason Haar

Information Security Manager
Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417




More information about the Snort-users mailing list