NethServer Version: 7.4.1708 Module: Suricata IPS Hi Community, I found an interesting behaviour in suricata. If I block “Policy” rule category, yum is blocked. Yum-cron is affected too. In evebox I see: ET POLICY GNU/Linux YUM User-Agent Outbound likely related to package management Yum update …

I don’t use NS for ips… with that in mind, I will say that et policy is not a category I would block. If your server isn’t vulnerable to poodle, and it should be patched, then that’s not a rule to be concerned with, as is all the rest of the traffic probing for content management vulnerabilities, e…

Suricata rule category "policy" blocks yum

Support

mrmarkuz (Markus Neuberger) October 1, 2018, 8:59pm 11

Here are some “safe” settings:

1 Like