Reply to thread

Message

<blockquote data-quote="AtlBo" data-source="post: 701230" data-attributes="member: 32547">Thanks very much [USER=37647]@shmu26[/USER].&nbsp; The details for expert mode are fantastic.&nbsp; This gives me a great place to start.I was whitelisting vulnerables on 2.2 as things turn out.&nbsp; <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite125" alt=":LOL:" title="Laugh&nbsp; &nbsp; :LOL:" loading="lazy" data-shortname=":LOL:" />&nbsp; Luckily I had NVT ERP running too because I really wasn&#039;t sure I knew what I was doing with ReHIPS.Going over the list of Unbound, I notice the &quot;vulnerables&quot; there, and I see how the rules are generally set to &quot;Inspect Children&quot;.&nbsp; That helps with the parent/child explaination on things.&nbsp; The protections seem to be here, but I can see why you pushed to have the choice for whitelisting a single command line handled in a more obvious way.&nbsp; True, it can become routine with use, but someone could start off on the wrong foot.The more I look this over, the more I am liking NVT ERP, ironically.&nbsp; I have about 100 or so vulnerables in ERP, and I am gaining a new respect for using it with this set of them in place.&nbsp; Not to take away from ReHIPS o/c, but it is interesting having both on the same machine.&nbsp; I&#039;ll probably keep the setup for awhile to make some comparisons.Really appreciate your always reliable help and also [USER=30916]@SHvFl[/USER]...<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /></blockquote>

[QUOTE="AtlBo, post: 701230, member: 32547"] Thanks very much [USER=37647]@shmu26[/USER]. The details for expert mode are fantastic. This gives me a great place to start. I was whitelisting vulnerables on 2.2 as things turn out. :LOL: Luckily I had NVT ERP running too because I really wasn't sure I knew what I was doing with ReHIPS. Going over the list of Unbound, I notice the "vulnerables" there, and I see how the rules are generally set to "Inspect Children". That helps with the parent/child explaination on things. The protections seem to be here, but I can see why you pushed to have the choice for whitelisting a single command line handled in a more obvious way. True, it can become routine with use, but someone could start off on the wrong foot. The more I look this over, the more I am liking NVT ERP, ironically. I have about 100 or so vulnerables in ERP, and I am gaining a new respect for using it with this set of them in place. Not to take away from ReHIPS o/c, but it is interesting having both on the same machine. I'll probably keep the setup for awhile to make some comparisons. Really appreciate your always reliable help and also [USER=30916]@SHvFl[/USER]...:) [/QUOTE]

Verification