It's not too hard to get another copy of snort running on ASL, even logging to a remote MySQL server. (Search these forums for more info.)
Also, you can add your own rules through the webmin. I suppose you could add rules through the console, but they'd probably get overwritten by new pattern updates.
Astaro is Linux based, so anything is possible. It just requires that you have sufficient Linux know how to implement the changes you want. You can log in as root and do anything you wish to the machine.
But it is a bad idea to modify the Astaro distribution. In a commercial installation, you'll void the warranty and make yourself inelligeble for technical support from Astaro. In any installation, home or office, you risk making your machine incompatible with the next service pack release.
If you want to do this to an Astaro box that you are just experimenting with, go ahead and experiment. However, if you are dealing with a production Astaro firewall machine that people other than yourself depend on, then I would suggest that you leave it alone.
