HP-UX Host Intrusion Detection System Version 4.1 Administrator's Guide

Configuring Ports
When HP-UX HIDS is first installed on the administration and agent systems, the ports
HP-UX HIDS uses are configured into the /etc/services file on each system as
follows:
hpidsadmin 2984/tcp #HP-UX Host IDS admin
hpidsagent 2985/tcp #HP-UX Host IDS agent
NOTE: Comments vary from configuration to configuration.
These are HP standard port numbers, registered with the Internet Assigned Number
Authority (IANA). If, for some reason you need to use different ports, you must change
the numbers 2984 and 2985 in all /etc/services files on the administration system
and all agent systems. If you are working with firewalls or NIS systems, you must also
make the changes as described in “Working with NIS” and “Working with Firewalls”.
Working with NIS
If any system is using NIS, you must configure NIS to use the HP-UX HIDS
communication ports. To configure NIS to use the HP-UX HIDS communication ports,
follow these steps:
1. Edit /etc/services on the NIS master server to add the two HP-UX HIDS ports
described in “Configuring Ports”.
2. Run /var/yp/ypmake on the NIS master server. For more information, see ypmake(
1M).
Working with Firewalls
If a firewall is positioned between the administration system and an agent system,
enable the ports that are used by HP-UX HIDS on the firewall. Check the values for
hpidsadmin and hpidsagent in the /etc/services file of the administration
system. Configure the firewall system to allow traffic to and from these ports. These
values must be the same on all administration, agent, and firewall systems. For more
information, see “Configuring Ports”.
If you use IPFilter as your firewall, see “Using HP-UX HIDS with IPFilter and
SecureShell” (page 279) for useful configuration information for both IPFilter and
SecureShell.
Enabling Multiple Agents
If you have more than about 20 agent systems, you may have to modify a kernel
parameter and a network parameter.
Configuring Ports 47