search

davidande / FSRM-ANTICRYPTO

Protect servers against crypto attacks
GNU General Public License v3.0
18 stars 4 forks source link

ext_to_accept.txt doesnt work #9

Closed markrholloway closed 5 years ago

markrholloway commented 5 years ago

Hi,

The code doesn't update the file group to remove extensions when adding file extensions to the ext_to_accept.txt file. I am using the most up to date PowerShell code on Windows Server 2012 R2.

Please can you assist?

Thanks,

Mark

davidande commented 5 years ago

Hello, Just checked on servers and it seems to work. Could You please copy and paste here your ext_to_accept.txt plz?

markrholloway commented 5 years ago

Hi,

Thanks for your response. Attached is ext_to_accept.txt

Mark

From: David Andé notifications@github.com Sent: 29 April 2019 08:00 To: davidande/FSRM-ANTICRYPTO Cc: markrholloway; Author Subject: Re: [davidande/FSRM-ANTICRYPTO] ext_to_accept.txt doesnt work (#9)

Hello, Just checked on servers and it seems to work. Could You please copy and paste here your ext_to_accept.txt plz?

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHubhttps://github.com/davidande/FSRM-ANTICRYPTO/issues/9#issuecomment-487470383, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AL5KUU7CL2BYOVFZSTSXSQLPS2MJZANCNFSM4HIMDNKQ.

PUT HERE THE LIST OF ALL EXTENSIONS PRESENT IN THE BLOCKED LIST, YOU WANT TO BE ACCEPTED

IN THE CASE A PROGRAM USES AN EXTENSION THAT IS LISTED AND FORBIDDEN.

ONE EXTENSION PER LINE.

.enc .one

davidande commented 5 years ago

It's correct. so when You try to write a file with *.enc in a share (that is protected), it's forbidden? try to delete extensions.old and launch the script again

If you can also launch the script manually in powershell ISE and copy paste the whole log plz?

markrholloway commented 5 years ago

Hi,

That is correct. When I save a file with either .enc or .one, the File Screen Template blocks the file from being saved to the share. I have checked the File group created by the script via File Server Resource Monitor and the extensions are still visible in the File group even though the PowerShell prints out they are being excluded...

[cid:ddf19487-2063-4bd2-a3cc-478ecf9e7103]

Thanks,

Mark

From: David Andé notifications@github.com Sent: 29 April 2019 09:54 To: davidande/FSRM-ANTICRYPTO Cc: markrholloway; Author Subject: Re: [davidande/FSRM-ANTICRYPTO] ext_to_accept.txt doesnt work (#9)

It's correct. so when You try to write a file with *.enc in a share (that is protected), it's forbidden?

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHubhttps://github.com/davidande/FSRM-ANTICRYPTO/issues/9#issuecomment-487504582, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AL5KUU47UGSEBPYDP4GOPLDPS2ZT3ANCNFSM4HIMDNKQ.

davidande commented 5 years ago

can You try the new version of the script plz and tell me if it works for You

markrholloway commented 5 years ago

Hi David,

Script now works perfectly. Many thanks for your quick response and fix. Great piece of code.

Thanks,

Mark

From: David Andé notifications@github.com Sent: 29 April 2019 11:38 To: davidande/FSRM-ANTICRYPTO Cc: markrholloway; Author Subject: Re: [davidande/FSRM-ANTICRYPTO] ext_to_accept.txt doesnt work (#9)

can You try the new version of the script plz and tell me if it works for You

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHubhttps://github.com/davidande/FSRM-ANTICRYPTO/issues/9#issuecomment-487532667, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AL5KUUZEHTNFPIBUAP3Q3SLPS3F3FANCNFSM4HIMDNKQ.

davidande commented 5 years ago

Ok that's good :-) Thanks for your support. By the way, i just did an update of the script because of the same problem found in share-to-accept function.