Host Intrusion Detection System Administrator's Guide Release 3.0

Configuration
Configuring Ports
Chapter 2
30
Configuring Ports
When HP-UX HIDS is first installed on the administration and agent systems, the ports
HP-UX HIDS uses are configured into the /etc/services file on each system, as follows
(the # comments may vary):
hpidsadmin 2984/tcp #HP-UX Host IDS admin
hpidsagent 2985/tcp #HP-UX Host IDS agent
These are the HP standard port numbers, registered with the Internet Assigned Number
Authority (IANA). If, for some reason, you need to use different ports, you must change
the numbers (2984 and 2985) in all /etc/services files on the administration system
and all agent systems. If you are working with firewall or NIS systems, you must also
make the changes as described in “Working with NIS” and “Working with Firewalls”,
below.
Working with NIS
If any system is using NIS, you must inform NIS of the HP-UX HIDS communication
ports. Perform the following steps:
Step 1. Edit /etc/services on the NIS Master server to add the two HP-UX HIDS ports
described in “Configuring Ports” above.
Step 2. Run /var/yp/ypmake on the NIS Master server; see ypmake (1M).
Working with Firewalls
If there is a firewall positioned between the administration system and an agent system,
be sure to enable the ports that are used by HP-UX HIDS. Check the values for
hpidsadmin and hpidsagent in the /etc/services file of the administration system.
Configure the firewall system to allow traffic to and from these ports. These values must
be the same on all administration, agent, and firewall systems. See “Configuring Ports”
above for further information.
If you are using IPFilter as your firewall, see “Using HP-UX HIDS with IPFilter and
SecureShell” on page 236 for useful configuration information for both IPFilter and
SecureShell.