HP-UX Host Intrusion Detection System Version 4.1 Administrator's Guide

Table of Contents
About This Document...................................................................................................................17
Intended Audience.............................................................................................................17
New and Changed Information in This Edition.................................................................17
Publishing History..............................................................................................................17
Document Organization.....................................................................................................18
Typographic Conventions..................................................................................................19
HP-UX Release Name and Release Identifier.....................................................................19
Related Information............................................................................................................20
HP Welcomes Your Comments...........................................................................................20
1 Introduction..............................................................................................................................21
Importance of Intrusion Detection.....................................................................................21
Who are the Perpetrators?.............................................................................................22
How are These Threats Realized?.................................................................................22
Misplaced Trust........................................................................................................22
Malicious Code........................................................................................................22
Strong Security with a Weak Link...........................................................................23
Exploitation of Critical Infrastructure Elements......................................................23
Misconfigured Software and Hardware..................................................................23
Excessive Privileges for Simple Tasks......................................................................23
Springboards to Attack the Next Target..................................................................23
Existing Tools Are Only Part of the Solution................................................................23
Firewalls...................................................................................................................24
Encryption................................................................................................................24
Security Auditing Tools...........................................................................................25
Intrusion Detection Technology....................................................................................25
HP-UX HIDS Functionality................................................................................................26
HP-UX HIDS Limitations..............................................................................................27
HP-UX HIDS Components.................................................................................................27
HP-UX HIDS Secure Communications.........................................................................30
Glossary of HP-UX HIDS Terms.........................................................................................30
2 Configuring HP-UX HIDS...........................................................................................................33
Required Configuration Steps............................................................................................33
Optional Configuration Steps.............................................................................................33
Setting Up HP-UX HIDS Secure Communications............................................................34
Configuring a Multihomed Agent System.........................................................................42
Example.........................................................................................................................43
Configuring a Multihomed Administration System..........................................................44
Table of Contents 3