Host Intrusion Detection System Administrator's Guide Release 3.1

ManualsBrandsHP ManualsSoftwareHP-UX Host Intrusion Detection System Software

261

262

263

264

265

266

267

268

269

270

Troubleshooting

Appendix G

255

System Manager starts with no borders or title bar in X client

programs on Windows

❏ This sometimes happens when Reﬂection X (or other X client programs on Microsoft

Windows) has been running for a while. Quit, restart the program, relogin to your

HP-UX HIDS administration system, and restart the System Manager. If the

problem persists, contact HP support.

System Manager times out on agent functions such as Activate

and Status Poll

❏ This may be the result of one of these problems: (1) idsagent has hung, (2) idsagent

has died or is not responding properly, or (3) the System Manager is expecting

responses back from the idsagent too quickly.

•Ifidsagent appears to have hung, restart idsagent. See “Forcing Active Agent

to Reread Conﬁguration File” on page 219.

• If the idsagent has died, then restart it. See “Starting HP-UX HIDS Agents” on

page 52.

• If the System Manager seems to be expecting responses back too quickly, then

increasing the Agent Response Timeout value may help alleviate the problem.

See “General Preferences” on page 118.

UNKNOWN program and arguments in certain alert messages

Sometimes, alerts occur specifying an UNKNOWN program and arguments. For

example:

uid=-1, gid=-1, pid=-1, ppid=-1 file=/dev/dlpi, type=4, mode=8630, uid=0, g

id=3, inode=128, device=1073741827 Non-owned file being modified User with

uid 0 opened for modificati on/truncation /dev/dlpi (type=4,inode=128,devic

e=1073741827) (owned by user with uid 0) when executing UNKNOWN, invoked wi

th UNKNOWN arguments, as process with p id 22125 and ppid 22124 and running

with effective uid=101 and with effective gid=10

See p.129 Limitations for details.

Using HP-UX HIDS with IPFilter and SecureShell

The HP-UX implementation of the IPFilter ﬁrewall system can be conﬁgured to allow

communication among the HP-UX HIDS administration and agent systems. IPFilter is a

stateful system that maintains the state of communications across multiple packets or

that monitors (proxies) an entire TCP/UDP session.

This section contains a sample set of the IPFilter rules that are needed to enable

communication among the HP-UX HIDS components. The IPFilter conﬁguration for

HP-UX HIDS can be helpful for conﬁguring another vendor’s ﬁrewall to allow proper

communication among the HP-UX HIDS components.