HP-UX Host Intrusion Detection System Version 4.1 Administrator's Guide

4. For each executable file, the agent sets certain environment variables and passes
the alert details as command-line parameters.
5. The agent executes the files one at a time in ASCII sorted order, but does not wait
for them to terminate.
NOTE: When alert aggregation is enabled, only aggregated alerts and alerts that
are not or cannot be aggregated follow the alert process above. For more
information about alert aggregation, see “Configuring Alert Aggregation”
(page 88).
The alert process does not apply to the additional real-time alerts that are issued
when both the alert aggregation and the real-time alerts options are enabled. These
additional real time alerts are not logged to IDS_ALERTFILE and are not sent to
the System Manager. Instead, they are only sent to any response programs in the
directory defined by the IDS_RT_RESPONSE_DIR configuration variable. The
default directory is /opt/ids/rt_response.
Security Checks
The following rules apply to the response directory and its files:
□ If the response directory fails these checks, then no response program is run.
• The directory must not be world-writable, that is, not writable by others.
• The directory must be owned by user ids.
• The directory must be local; it cannot be a symbolic link, a pipe, NFS-mounted,
and so on.
□ If a response program fails these checks, it is not run.
• A file in the response directory must be a local regular file; it cannot be a
symbolic link, a pipe, NFS-mounted, and so on.
• A file in the response directory must not be world-writable.
Programming Notes
1. Response programs run with the same user ID as the HP-UX HIDS agent. While
this is not a privileged user ID, you can modify and delete HP-UX HIDS files using
this ID. Pay attention to security issues when planning alert response design.
2. Response programs are detached from a controlling terminal and runs as a
background process. Standard output and standard error are both redirected to
the error log file, as defined by the IDS_ERRORFILE configuration variable. The
default is /var/opt/ids/error.log.
3. If you must transmit alert information to another system, set up your own secure
communication process.
4. If a response program has its setuid or setgid bit set, it runs as that effective
user or group. It is a good practice to restrict setuid and setgid programs to
How Automated Response Works in HP-UX HIDS 193