RE: script help please
- From: "David Farinic" <davidf@xxxxxxx>
- To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
- Date: Mon, 8 Nov 2004 09:38:48 +0100
First understand in which scenarios IP dest.s. entries would not work.
This was already posted here By TOM:
http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/faq-urldomain
namesets.mspx
I posted this:
------------------------------------------------------------------------
-
http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/faq-urldomain
namesets.mspx
Says "- You cannot specify a URL set as an IP address"
Well works on mine self auto-updating MALWARE URL set OK They probably
meant to say:
"- If you specify a URL set as an IP address it would be applied to ALL
http proxy requests and to SNAT web redirected http client requests
containing IP address in "Host: " field of http request(i.e. all current
browsers(http 1.1))"
Meaning if you will have SNAT client not using proxy connecting
directly and he will query http request for URL containing IP address
with some old browser (~1994) he will get through even when you specify
that IP address in URL set.
------------------------------------------------------------------------
-
So once you understand if you are "safe" to ad IP DS entries
Just remove part of script which checks for IP only site names
(probably some regex)
BTW I am working right now on similar app(&script) which is updating
Malware DS every 30 min. And definitely IP entries will be present as
well but they will usually expire in 1 year time from time of site
misuse.
With Regards DavidF
-----Original Message-----
From: Ara [mailto:ara@xxxxxxxxxx]
Sent: Sunday, November 07, 2004 12:51 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] script help please
http://www.ISAserver.org
Can some one help me with this issue here?
If you go to http://www.squidguard.org/download/
then there is a link to download blacklisted sites. After extracting you
will get different categories. Let's say you go to porn categories and
there
is a file which has all links.
The problem is they are formatted in a way that only works with squad
guard
installed. As an example,
101tits.com/lesbian
12.105.86.9/amateurlesbians
I want to convert these to destination sets but it is complaining that
there
shouldn't be any ip in list. Only domains are allowed.
So if someone is good in writing scripts, may I ask to make something
that
deletes line with ip address keeping the one with url's.
Or
Script is posted
http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=33;t=000056
But it gives me hard time. Maybe I am doing something wrong and help is
appreciated
Thank you
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
World of Windows Networking: http://www.windowsnetworking.com
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
davidf@xxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist
Report abuse to listadmin@xxxxxxxxxxxxx
This mail was checked for malicious code and viruses
by GFI MailSecurity. GFI MailSecurity provides email content
checking, exploit detection, threats analysis and anti-virus for
Exchange & SMTP servers. Viruses, Trojans, dangerous
attachments and offensive content are removed automatically.
Key features include: multiple virus engines; email content and
attachment checking; an exploit shield; an HTML threats engine;
a Trojan & Executable Scanner; and more.
In addition to GFI MailSecurity, GFI also produces the
GFI MailEssentials anti-spam software, the GFI FAXmaker
fax server & GFI LANguard network security product ranges.
For more information on our products, please visit
http://www.gfi.com. This disclaimer was sent by
GFI MailEssentials for Exchange/SMTP.
Other related posts:
