Host Intrusion Detection System Administrator's Guide Release 3.1

Templates and Alerts
Creation and Modification of Setuid File Template
Appendix A
158
Creation and Modification of Setuid File Template
The vulnerability
addressed by this
template
A setuid file is one that, if executed, operates with the permissions of the owner of the
file, not of the person executing the file. One of the frequent back doors that an intruder
installs on a system is the creation of a copy of the /bin/sh program that is setuid root.
Such a file allows any command to be executed as the superuser.
How this template
addresses the
vulnerability
The setuid (SUID) template detects the creation and modification of files with setuid
privileges owned by privileged users by monitoring for the following:
• Modifying file permissions to enable the setuid bit on a file owned by a privileged
user.
• Changing the owner of a setuid file to be owned by a privileged user.
• Creation or modification of a file that has the setuid bit set and that is owned by a
privileged user.
By detecting the creation and modification of a setuid file as soon as it occurs, the
template can provide a timely security report to an administrator regarding a potential
security intrusion. There are no known mechanisms in existence for the HP-UX
operating system that can provide a near real-time report of the creation or modification
of setuid files.
How this template
is configured
Table A-13 lists the configurable properties that this template supports.
Properties A brief description about the configurable properties are listed below:
• Property: priv_uid_list
A list of system-level user IDs.
This list should contain those users who are considered to have elevated access to
the system. Removing any of these means that this template will not detect the
creation of a setuid file owned by one of those users.
• Properties: pathnames_X, programs_X
You can use these properties to filter out alerts generated when a particular program
creates, modifies or enables a particular privileged setuid file. See “Type II: Path
Names/Programs Pairs” on page 132 for a detailed description of these property
pairs.
Alerts generated
by this template
See “Setuid File Created or Modified” on page 159 for more information about the alerts
generated.
Table A-13 Setuid File Template Properties
Name Type Default Value
priv_uid_list III 0 | 1 | 2 | 3 | 4 | 5 | 9 | 11
pathnames_X II <empty>
programs_X II <empty>