How to Disable a Critical System Protection/Data center Security agent running on a Linux system.

Products

• Critical System Protection
• Data Center Security Server
• Data Center Security Server Advanced

Issue/Introduction

Disable a Critical System Protection (CSP) /Data center Security(DCS) agent running on a Linux system

Resolution

• Apply the Null policy on the agent via the DCS/CSP manager 

OR

• Login to machine as 'root' and run the following commands:

 

./sisipsconfig.sh –r (this forces the agent to run the built-in policy that is the equivalent of the NULL policy)

OR

• Login to machine as 'root' and run the following commands:

 

Disable IPS and RT-FIM drivers:

• • • su - sisips
    • ./sisipsconfig.sh –i (in 5.2.9 and later you can use -ips off instead so you do not have to worry about the toggle affect)
      As this is a toggle, make sure output shows that you have disabled the prevention driver
    • ./sisipsconfig.sh –rtfim off
    • exit

 

Stop the daemons (as root):

• • • /etc/init.d/sisipsagent stop
    • /etc/init.d/sisidsagent stop
    • /etc/init.d/sisipsutil stop

Disable Agent startup scripts:

• • Rename the agent scripts, which temporarily breaks any symbolic links in the rc#.d startup scripts:

• • • mv /etc/init.d/sisipsagent /etc/init.d/sisipsagentOFF
    • mv /etc/init.d/sisidsagent /etc/init.d/sisidsagentOFF
    • mv /etc/init.d/sisipsutil /etc/init.d/sisipsutilOFF

 

• • Reboot system to cause drivers to be disabled.