- Apply the Null policy on the agent via the DCS/CSP manager
OR
- Login to machine as 'root' and run the following commands:
./sisipsconfig.sh –r (this forces the agent to run the built-in policy that is the equivalent of the NULL policy)
OR
- Login to machine as 'root' and run the following commands:
Disable IPS and RT-FIM drivers:
-
-
- su - sisips
- ./sisipsconfig.sh –i (in 5.2.9 and later you can use -ips off instead so you do not have to worry about the toggle affect)
As this is a toggle, make sure output shows that you have disabled the prevention driver
- ./sisipsconfig.sh –rtfim off
- exit
Stop the daemons (as root):
-
-
- /etc/init.d/sisipsagent stop
- /etc/init.d/sisidsagent stop
- /etc/init.d/sisipsutil stop
Disable Agent startup scripts:
-
- Rename the agent scripts, which temporarily breaks any symbolic links in the rc#.d startup scripts:
-
-
- mv /etc/init.d/sisipsagent /etc/init.d/sisipsagentOFF
- mv /etc/init.d/sisidsagent /etc/init.d/sisidsagentOFF
- mv /etc/init.d/sisipsutil /etc/init.d/sisipsutilOFF
-
- Reboot system to cause drivers to be disabled.