davidande / FSRM-ANTICRYPTO

Protect servers against crypto attacks
GNU General Public License v3.0
18 stars 4 forks source link

Feature Request? #10

Open markrholloway opened 5 years ago

markrholloway commented 5 years ago

Hi David,

Would it be possible to add the ability to include files in the file groups list (like you do to remove extensions with the ext_to_accept.txt to remove file extensions) or have the ability to include multiple file groups already created within the file screen template? I.e add the file group name to an Include_Group.txt file? This then gets added to the file screen template when re-created?

I ask, as every time the code is run, the file screen templates get removed and re added, which then remove any other file groups or manually added extensions from the file group/or template. A limitation of File Server Resource Manager is that you cant have multiple screen templates on a given share which is a shame if you also want to exclude executable files etc.

I hope that makes some sense?

Thanks in advance,

Mark

davidande commented 5 years ago

Hello,

I see what you mean.

I can do something around include_list, but it will be applied on all shares. + David

De : markrholloway notifications@github.com A : davidande/FSRM-ANTICRYPTO FSRM-ANTICRYPTO@noreply.github.com Cc : Subscribed subscribed@noreply.github.com Envoyé : 20/05/2019 13:31 Objet : [davidande/FSRM-ANTICRYPTO] Feature Request? (#10)

Hi David, Would it be possible to add the ability to include files in the file groups list (like you do to remove extensions with the ext_to_accept.txt to remove file extensions) or have the ability to include multiple file groups already created within the file screen template? I.e add the file group name to an Include_Group.txt file? This then gets added to the file screen template when re-created? I ask, as every time the code is run, the file screen templates get removed and re added, which then remove any other file groups or manually added extensions from the file group/or template. A limitation of File Server Resource Manager is that you cant have multiple screen templates on a given share which is a shame if you also want to exclude executable files etc. I hope that makes some sense? Thanks in advance, Mark — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

davidande commented 5 years ago

You can try this in the fsrmnocrypto directory add the file ext_to_include.txt you can edit it by addind the extensions you want to include (1 per line)

in the script add the lines after 165

Including extension manually from the extension list ext_to_include.txt

$InclExtensions= Get-Content $PSScriptRoot\ext_toinclude.txt | ForEach-Object { $.Trim() } | Where-Object {$_ -notlike "#*"} $monitoredExtensions = $monitoredExtensions + $Inclextensions if (!$InclExtensions) { Write-Host "Extensions in ext_to_include.txt is empty" } else { Write-Host "Extensions in ext_to_include.txt added : $inclExtensions" }

test it. it works for me

markrholloway commented 5 years ago

Hi David,

Works for me too after editing your code with the following and placing it after line 166...

$InclExtensions= Get-Content $wkdir\ext_toinclude.txt | ForEach-Object { $**.Trim() } | Where-Object {$_* -notlike "#"} $monitoredExtensions = $monitoredExtensions + $Inclextensions if (!$InclExtensions) { Write-Host "Extensions in ext_to_include.txt is empty" } else { Write-Host "Extensions in ext_to_include.txt added : $inclExtensions" }

Many thanks again,

Mark

davidande commented 5 years ago

Great $PSScriptRoot should work too fot that, You need to replace all $wkdir with $PSScriptRoot after that $kdit is not used anymore :-)