Host Intrusion Detection System Administrator's Guide Release 3.0

Troubleshooting
Troubleshooting
Appendix G
249
• If the idsagent has died, then restart it. See “Starting HP-UX HIDS Agents” on
page 52
• If the System Manager seems to be expecting responses back too quickly, then
increasing the Agent Response Timeout value may help alleviate the problem.
See “General Preferences” on page 116.
UNKNOWN program and arguments in certain alert messages
Sometimes, alerts occur specifying an UNKNOWN program and arguments. For
example:
uid=-1, gid=-1, pid=-1, ppid=-1 file=/dev/dlpi, type=4, mode=8630, uid=0, g
id=3, inode=128, device=1073741827 Non-owned file being modified User with
uid 0 opened for modificati on/truncation /dev/dlpi (type=4,inode=128,devic
e=1073741827) (owned by user with uid 0) when executing UNKNOWN, invoked wi
th UNKNOWN arguments, as process with p id 22125 and ppid 22124 and running
with effective uid=101 and with effective gid=10
See p.129 “Limitations” for details.
Using HP-UX HIDS with IPFilter and SecureShell
The HP-UX implementation of the IPFilter firewall system can be configured to allow
communication among the HP-UX HIDS administration and agent systems. IPFilter is a
stateful system that maintains the state of communications across multiple packets or
that monitors (proxies) an entire TCP/UDP session.
This section contains a sample set of the IPFilter rules that are needed to enable
communication among the HP-UX HIDS components. The IPFilter configuration for
HP-UX HIDS can be helpful for configuring another vendor’s firewall to allow proper
communication among the HP-UX HIDS components.
IPFilter rules for HP-UX HIDS
This is a sample set of IPFilter rules needed to enable HP-UX HIDS. If you use a firewall
other than IPFilter, the explanation presented here should give you enough pointers to
set up your own firewall rules.
1. HP-UX HIDS agent listens on port hpidsagent (2985) for incoming connections
initiated by HP-UX HIDS System Manager on a remote host.
So if the host running IPFilter is also running an HP-UX HIDS agent, then allow
incoming connections initiated by HP-UX HIDS System Manager.
pass in quick proto tcp from any to any port = hpidsagent keep state
2. HP-UX HIDS System Manager listens on port hpidsadmin (2984) for incoming
connections initiated by HP-UX HIDS agents.
If the host running IPFilter is also running an HP-UX HIDS System Manager, then
allow incoming connections initiated by HP-UX HIDS agents.
pass in quick proto tcp from any to any port = hpidsadmin keep state
3. HP-UX HIDS System Manager uses ephemeral ports to send requests to agent host’s
port hpidsagent. Also, HP-UX HIDS agents use ephemeral ports to send responses
to the System Manager host’s port hpidsadmin.