Host Intrusion Detection System Administrator's Guide Release 3.0

Templates and Alerts
Modification of Another User’s File Template
Appendix A
163
Modification of Another User’s File Template
The vulnerability
addressed by this
template
In many environments, users are expected to be working with their own files. An
attacker attempting to compromise the security of a system might cause a system
program to modify various files owned by other system users. Because many daemons
run as a particular user, this template may generate an alert when a compromised
daemon causes such an attack.
How this template
addresses the
vulnerability
The template, also known as the Not Owned (NO) template, monitors files that are
deleted, renamed, modified or are open to be modified by users that do not own the files,
where a file can be a regular file, a directory, a symbolic link or a special file. Specifically,
the template monitors the following modifications or potential modifications of
"non-owned" files.
• Monitors for successful attempts to open a regular or special file to write or append,
or to truncate the file by users who do not own the file even though the file’s group
permissions specifies write permission. Also monitors for successful attempts to
delete or rename regular files, directories, symbolic links, or special files.
• Monitors for changes in ownership or file permissions of files by users who do not
own the file.
This template does not determine that a file’s contents were changed, only that a change
might have been made (i.e., it does not watch the content of the files, only that a file was
opened with write permission). Instead of monitoring write(2) calls that modify files,
successful opens to write to or truncate the file by non-owners are monitored to provide
early detection of processes that might modify files.
How this template
is configured
This template supports the following properties:
Table A-17 Template Properties
Name Type Default Value
pathnames_to_not_watch I ^/dev/null$ | ^/etc/rc˙log$ | ^/dev/tty$ |
^/var/opt/OV/tmp/OpC/ | ^/var/spool/
sockets/pwgr/ | ^/dev/pts/
uids_to_ignore III <empty>
uid_pairs_to_ignore IV 0,1 | 0,2 | 0,3 | 0,4
pathnames_1 II ^/var/adm/wtmp$ & ^/dev/tty$ |
^/var/adm/sulog$ & ^/dev/log$ & ^/dev/tty$
programs_1 II ^/usr/lbin/rlogind$ & ^/usr/bin/login$ &
^/usr/lbin/telnetd$ & ^/usr/lbin/ftpd$ &
^/usr/bin/tset$ | ^/usr/bin/su$
pathnames_X II <empty>
programs_X II <empty>