
Set IPS Options to Off in the ePO console and apply the policy to the client.•
• Run the command: hipts engines MISC:off.
2 Run the command: /etc/rc2.d/S99hip stop.
Restarting the Solaris client
You may need to stop a running client and restart it as part of troubleshooting.
Task
1 To restart a client, run the command: /etc/rc2.d/S99hip restart.
2 Enable IPS protection. Use one of these procedures, depending on which you used to stop
the client:
• Set IPS Options to On in the ePO console and apply the policy to the client.
• Run the command: hipts engines MISC:on.
Overview of the Linux client
The Host Intrusion Prevention Linux client identifies and prevents potentially harmful attempts
to compromise a Linux server’s files and applications. It leverages the native SELinux protection
mechanism, translating IPS policies into SELinux rules and SELinux events back to IPS events,
and provides easy management from the ePO console.
Policy enforcement with the Linux client
Not all policies that protect a Windows client are available for the Linux client. In brief, Host
Intrusion Prevention protects the host server from harmful attacks but does not offer network
intrusion protection, including buffer overflow. The policies that are valid are listed here.
These options are available...With this policy...
HIP 7.0 GENERAL:
None except admin or time-based password to allow use of the
troubleshooting tool.
Client UI
NoneTrusted Networks
Only Mark as trusted for IPS and New Process Name to add trusted
applications.
Trusted Applications
HIP 7.0 IPS:
IPS Options • Enable HIPS
• Enable Adaptive Mode
• Retain existing Client Rules
AllIPS Protection
IPS Rules • Exception Rules
• Signatures (default and custom HIPS rules only)
Note: NIPS signatures and Application Protection Rules are not
available.
AllIPS Events
Working with Host Intrusion Prevention Clients
Overview of the Linux client
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0102
Comentarios a estos manuales