Hi All,
Just want to double check how the IPS work in Astaro as I want to tune it.
1) Currently I simply turn ON ALL the Rules ( Including the warn) with the mindset that I rather be "safer" with more rules, live with false alarms than to get attacked.
2) As time pass, have to admit the slowness is kind of getting on my nerves and thus now I want to tune it.
3) I am kind of confused with some things.
My network only has Windows XP Machines and a HAVA Device (Like a Slingbox)
3.1) Under the OS I am sure Windows is a YES.
But I am not sure if I should turn OFF LINUX since Astaro is Linux, by turning on Linux, does it protect Astaro Itself ?
As for the Others, what kind of machines fall under that catagory, what do I lose / risk if I turn that off.
3.2) For the Servers, I do not have any Servers in my network but I do have Astaro SMTP Proxy running which relays mails to my ISP. BUT Astaro SMTP Ports are open even if you just relay mails to ISP. I did several other configurations to "lock down" this SMTP.
Thus since Astaro SMTP is running, does keeping the E-mail Rules ON Help or no it does not help at all.
As for those under HTTP or any other under Server, the reason I keep it on is I think if a machine on my network is compromised which in turn tries to compromise others, I may be able to see something but that idea does not apply if the IPS only detect incoming attacks to My Servers and not out going.
3.3) For those Attack Against Client Software, I believe I should turn all ON, let me know if you think other wise.
3.4) Protocol Anomaly to the best of my knowledge is when traffic does not complies to the standard but in a client only network, do I need this or I should turn it Off?
3.5) Malware -> Obvious I should keep this ON.
3.6) Instant Messaging -> My MSN and Skype I force it over SOCKS, so I should still keep this ON?
3.7) Multimedia Applications -> I simply keep all ON.
Thus assuming I turn OFF the following, do you think I made any mistakes?
LINUX : Since I do not have any linux machines other than Astaro.
OS Others: Since I only have Windows and I do not know others what does it cover.
Server: Everything under Server since I do not have server and assuming those SMTP, POP, HTTP, FTP Proxy etc is not using this IPS to protect it.
(IE: I assume it means to protect a Real Server other than those on Astaro itself)
Protocol Anomaly: I am not sure but for performance sake, I am thinking of turning it off.
Let me know what you think.
Thank You,
This thread was automatically locked due to age.
