Administrator's Guide

Schedule Manager Screen

Conﬁguring Detection Templates

Chapter 5

Some Template Conﬁguration Guidelines

• The “Race Condition Template” on page 141 imposes the highest overhead in terms

of the load it places on correlator process. We recommend that you not include this

template in your initial schedule.

NOTE The race condition template checks, among other things, for the execution of setuid

scripts, which are vulnerable to a race condition attack. In HP-UX 11i version 1.6

and later, the execution of setuid scripts is prevented by default by the

secure_sid_scripts tunable kernel parameter. See the secure_sid_scripts (5)

manpage for details.

• The template “Modiﬁcation of Files/Directories Template” on page 146 provides for

real-time ﬁle-change detection. Any modiﬁcation made to any ﬁles or directories

within the directory tree speciﬁed in the template will be detected and reported.

However, the template can generate many alerts which are not security relevant.

The “Files Modiﬁed by Program List/Program List” properties can be used to ignore

changes to certain ﬁles when they are performed by a known program. The “Ignore”

properties can be used to ignore directories and ﬁles where changes to ﬁles are not

considered security risks.

• The template “Modiﬁcation of Another User’s File Template” on page 163 will

generate many alerts if not tuned well. We recommend that you use the template

“Modiﬁcation of Files/Directories Template” on page 146 in its place.

• When tuning a template, consider what the areas of greatest risk are if the system is

penetrated. Obviously, replacing a program in /bin, /sbin or the kernel in /stand is

a serious threat. But so is modifying ﬁles under /etc or /opt. You may have

additional site-speciﬁc directories you are concerned about.

• What areas can you ignore, or are you willing to tolerate a threat in? For example,

many ﬁles change under /var/adm, and ignoring that directory is usually safe. But if

a symbolic link attack is launched from /var/adm, you will miss it. This is a trade-off

decision.

• The templates “Repeated Failed Logins Template” on page 173 and “Repeated Failed

su Commands Template” on page 176 exact a very low overhead on the system and

can be run in any schedule.

• Start with a single template and then see how many alerts you get. Determine if any

of these are security events, and if not, modify the template properties to remove the

spurious alerts.

• You may ﬁnd software that is behaving incorrectly, such as writing to /opt

(considered a read-only ﬁle system), creating world-writable lock ﬁles (a security

issue), saving temporary data in /etc (should only be for conﬁguration data).

Contact the software vendor about these programs.