From a6bf60bc3c96bac22ff2259ee02099f5bdeef008 Mon Sep 17 00:00:00 2001 From: William Stearns Date: Tue, 5 Dec 2023 18:59:38 -0500 Subject: [PATCH] Disable extract-certs-pem.zeek --- install.sh | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/install.sh b/install.sh index 9caed452..970a5fb2 100755 --- a/install.sh +++ b/install.sh @@ -322,13 +322,14 @@ __enable_ssl_certificate_logging() { echo '@load protocols/ssl/validate-certs' >>"$local_path/local.zeek" fi - if ! grep -q '^[^#]*@load *policy/protocols/ssl/extract-certs-pem' "$local_path/local.zeek" ; then - echo '' >>"$local_path/local.zeek" - echo '#Log certificates' >>"$local_path/local.zeek" - echo '@load policy/protocols/ssl/extract-certs-pem' >>"$local_path/local.zeek" - echo 'redef SSL::extract_certs_pem = ALL_HOSTS;' >>"$local_path/local.zeek" - echo '' >>"$local_path/local.zeek" - fi + #Removed 202312 WLS because extract-certs-pem.zeek does not appear to be part of Zeek anymore. If needed in the future, see if log-certs-base64.zeek is a suitable replacement. + #if ! grep -q '^[^#]*@load *policy/protocols/ssl/extract-certs-pem' "$local_path/local.zeek" ; then + # echo '' >>"$local_path/local.zeek" + # echo '#Log certificates' >>"$local_path/local.zeek" + # echo '@load policy/protocols/ssl/extract-certs-pem' >>"$local_path/local.zeek" + # echo 'redef SSL::extract_certs_pem = ALL_HOSTS;' >>"$local_path/local.zeek" + # echo '' >>"$local_path/local.zeek" + #fi } __configure_zeek() {