Re: Ransomware/Cryptoware prevention

now i tested the fpolicy and it works fine:

nodeb> fpolicy create f_Ransomware screen
File policy f_Ransomware created successfully.
nodeb> fpolicy ext inc set f_Ransomware locky,xxx,zzz
nodeb> fpolicy monitor set f_Ransomware -p cifs,nfs create,rename
nodeb> fpolicy options f_Ransomware required on
nodeb> fpolicy enable f_Ransomware
Warning: User requests may be denied because there are no file screening servers registered with the filer. Are you sure? y
File policy f_Ransomware (file screening) is enabled.

now you can´t rename or create any files with extension lockyxxx,zzz

regards

stefan