[Snort-users] rules update
Jason.Haar at ...294...
Wed Nov 21 12:33:07 EST 2001
On Tue, Nov 20, 2001 at 11:31:08AM -0500, Matt Kettler wrote:
> Still it is not likely a good idea to automatically update from a cron job
> for the other reasons (purposeful or accidental check-in dysfunctional
> rules, etc).
> Perhaps I'm off-base, but it does strike me as a bad idea to automatically
> pull rules updates from CVS. Although I do agree with the idea of using cvs
> update to pull out the latest rules manually with minimal headaches.
> Anyone have any more insightful comments on that issue than I can provide?
I agree entirely. I have asked for ages that all rules be PGP signed - at
least then you'd know if they'd been dicked with!
Anyway, what I do here is cron-pull down the rules every day, and diff them
against the "live set". Any changes are Email'ed to me. Then I can view the
changes, and if they look OK, do a "scriptname -live" to move them live.
Information Security Manager
Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
More information about the Snort-users