#  This software was derived from SATAN 1.1.1 by Dan Farmer and Wietse Venema
#  (http://www.porcupine.org/satan).
#
#
#
$full="OFF";
$sara="OFF";

print CLIENT <<EOF;
<HTML>
<HEAD>
<SCRIPT language="JavaScript">
  function movepic(img_name,img_src) {
  document[img_name].src=img_src;
}
</SCRIPT>
<title> SARA Corrections and Drops</title>
<LINK REV="made" HREF="mailto:sara\@arc.com">
</HEAD>
<BODY>
EOF
if ($pi_menu) {
  $screen = &$pi_menu;
} else {
  $screen = print_menu();
}
$screen =~ s/\\n/\n/g;
print CLIENT $screen;
print CLIENT <<EOF;
</TD><TD valign=top>

<Center> <H2>SARA Corrections and Drops</H2></Center>
<hr>
SARA provides two facilities to modify the outcome of the 
scan.  They are:
<P>
<OL>
<LI><B>Corrections Database</B>
<P>
SARA provides a capability to remove specified entries from SARA
reports generated by the SARA ReportWriter.  These corrected entries
will not be displayed in the ReportWriter bar chart or summary table.
They will be identified in the host details and vulnerability listing.
Corrections can be accomplished through the <i>rules/corrections</i>
database.  A sample file is provided below:
<UL>
<PRE>

# Host|String in last field in facts record|Requester|Date of request
home.dummy.gov|RDS|Bob Todd|20 October 2000
homepc.local.dummy.gov|LPRng|Ann Todd|February 2001

</PRE>
</UL>
The first entry will block reporting of the RDS vulnerability on 
<i>home.dummy.gov</i>.  You might do this if you know that you have
a non vulnerable RDS configuration.  The second entry blocks 
reporting of the LPRng vulnerability on Linux machines.  You might
do this if you patched LPRng on Red Hat 7.0.
<P>
<LI><B>Drop Database</B>
<P>
SARA provides a capability to drop records from the SARA raw database.
There is no record of the vulnerability in any of the SARA databases.
Record dropping can be accomplished through <i>rules/drop</i> database.
A sample file is provided below:
<UL>
<PRE>

\$text =~ /exports \/cdrom/i
\$service_output =~ /JD FTP/ && \$text =~ /offers ftp/
\$service_output =~ /Lexmark/ && \$text =~ /offers ftp/

</PRE>
</UL>
The first entry deletes any record where the text field contains '/cdrom'.
You might use this if you don't care if IRIX systems export the cdrom.  The
second entry deletes records where Jet Direct printer offer writable FTP
directories.  The third record is simimlar but is directed to Lexmark printers.
<HR> 
</TD>/<TR>
</TABLE>
</UL></UL>
</BODY>
</HTML>
EOF
