Manualshelf

Host Intrusion Detection System Administrator's Guide Release 3.0

ManualsBrandsHP ManualsSoftwareHP-UX Host Intrusion Detection System Software
251252253254255256257258259260
Troubleshooting
Troubleshooting
Appendix G
240
Troubleshooting
This section describes a variety of potential problems and their solutions. To stay current
with product updates and patches, be sure to monitor the HP security software news and
events web site at www.hp.com/security.
Agent and System Manager cannot communicate with each other
(No errors are being generated by the HP-UX HIDS processes and everything seems to
be running fine otherwise.) See also “No Agent Available” on page 246.
❏ Make sure the check sums on the following two files are identical:
On the Administration system, run:
/usr/bin/cksum /etc/opt/ids/certs/admin/cacert.pem
On the Agent system, run:
/usr/bin/cksum /etc/opt/ids/certs/agent/cacert.pem
If the results are different, the Administration and Agent certificates are not signed
by the same trusted certificate authority and the communication handshake fails.
To correct this, regenerate the agent certificate and install the new certificate bundle
on the agent system. Recheck the check sums to verify that they match.
❏ If there is a firewall positioned between the administration system and an agent
system, be sure the HP-UX HIDS ports are enabled. See “Working with Firewalls” on
page 30.
❏ If you are using NIS on these systems, it is likely the port information is not being
retrieved from your /etc/services file.
• Inform the NIS Master about the HP-UX HIDS ports. See “Working with NIS”
on page 30.
• Launch the System Manager and verify that the agent is now available.
❏ Increase the response timeout in the Preferences screen. See “General Preferences”
on page 116.
❏ Increase the value for IDS_SSL_TIMEOUT in the agent configuration file, ids.cf. See
“Remote Communication Configuration” on page 209.
❏ If the agent system is multihomed, make sure the agent and administration systems
are properly configured. See “Configuring a Multihomed Agent System” on page 25.
❏ If the administration system is multihomed, make sure the agent and
administration systems are properly configured. See “Configuring a Multihomed
Administration System” on page 27.