search

nexxai / CryptoBlocker

A script to deploy File Server Resource Manager and associated scripts to block infected users
GNU General Public License v2.0
200 stars 73 forks source link

Local Update #10

Closed opticalhaze closed 7 years ago

opticalhaze commented 7 years ago

We have found your script and think thats it's abolsultely brilliant. I have tested it and was hoping to make an amendment to point it to a local drive, but as I have basically no powershell skills I thought I would ask if you knew how to make the adjustment to point to a filepath.

nexxai commented 7 years ago

Not sure what you mean by "point[ing] it to a local drive". What are you trying to have the local drive do?

opticalhaze commented 7 years ago

Essentially I would like to save your updated extension file locally and update devices by pointing them to a server rather than https://fsrm.experiant.ca/api/v1/get.

Kind Regards,

James Skingle

3rd Line Support Engineer / Account Manager Providing 1st class Business IT Services and Support

Main Line: 08000 30 20 30 Fax Line: 01233 501 946 DDI: 01233 656925

From: Justin Smith [mailto:notifications@github.com] Sent: 16 May 2017 15:25 To: nexxai/CryptoBlocker CryptoBlocker@noreply.github.com Cc: James Skingle | MPR Tech Support james@mpr-it.co.uk; Author author@noreply.github.com Subject: Re: [nexxai/CryptoBlocker] Local Update (#10)

Not sure what you mean by "point[ing] it to a local drive". What are you trying to have the local drive do?

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHubhttps://github.com/nexxai/CryptoBlocker/issues/10#issuecomment-301798753, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AbZv4ndOEwLXBrg6rTuNzT-b83ryubwHks5r6bGhgaJpZM4Nck8L.

Email Disclaimer - Click Here to See Disclaimerhttp://www.mpr-it.co.uk/company-information/email-disclaimer

nexxai commented 7 years ago

I'm no PowerShell master but I believe you would just change line 197 from

$jsonStr = $webClient.DownloadString("https://fsrm.experiant.ca/api/v1/get")

to

$jsonStr = C:\Path\Where\File\Resides.json

But that means that any time you want to update the list (which usually happens multiple times per day), you'll have to manually download a copy first so that you can save it to the local disk.

Can I ask why you want to load it from the local disk and not the internet?

opticalhaze commented 7 years ago

Hi Justin,

It was a question as we are looking at centralising it for our customers but keeping us in control of the changes. We have actually managed to find a solution. Your idea is a brilliant one with FSRM.

Kind Regards,

James Skingle

3rd Line Support Engineer / Account Manager Providing 1st class Business IT Services and Support

Main Line: 08000 30 20 30 Fax Line: 01233 501 946 DDI: 01233 656925

From: Justin Smith [mailto:notifications@github.com] Sent: 16 May 2017 15:31 To: nexxai/CryptoBlocker CryptoBlocker@noreply.github.com Cc: James Skingle | MPR Tech Support james@mpr-it.co.uk; Author author@noreply.github.com Subject: Re: [nexxai/CryptoBlocker] Local Update (#10)

I'm no PowerShell master but I believe you would just change line 197 from

$jsonStr = $webClient.DownloadString("https://fsrm.experiant.ca/api/v1/get")

to

$jsonStr = C:\Path\Where\File\Resides.json

But that means that any time you want to update the list (which usually happens multiple times per day), you'll have to manually download a copy first so that you can save it to the local disk.

Can I ask why you want to load it from the local disk and not the internet?

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHubhttps://github.com/nexxai/CryptoBlocker/issues/10#issuecomment-301800824, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AbZv4sSIgRiDmzaAas4GNHCvPTekGTxUks5r6bMagaJpZM4Nck8L.

Email Disclaimer - Click Here to See Disclaimerhttp://www.mpr-it.co.uk/company-information/email-disclaimer

PaulyHaley commented 7 years ago

This is an interesting scenario. Are you saying that we should run the script daily to get the latest copy of the file which is always being constantly updated? Our only objection and I am guessing this is why James wants a local copy is to vet the file first to make sure there are no mistakes like .pdf which would prevent a user from saving a legit file.

As you know from my post then in this case we would need the script to see our share on the C drive, in order to create it every time.

nexxai commented 7 years ago

The script should be run on some sort of regular basis to get the latest filescreen updates. I've heard the some people run it every hour, some run it every day, and some run it every week. It all depends on your environment.

We also include the concept of a SkipList which every environment should configure with their specific list of file extensions that they know they're going to use (e.g. .pdf or .docx or whatever) so that even if that screen gets added to the list, it will not adversely impact your setup.