HP-UX Host Intrusion Detection System Version 4.2 Administration Guide

ManualsBrandsHP ManualsSoftwareHP-UX Host Intrusion Detection System Software

Repeated Failed Logins Template.......................................................................................................151

Failed Login Attempts...................................................................................................................152

Repeated Failed su Commands Template..........................................................................................153

Repeated Failed su Attempts........................................................................................................154

Log File Monitoring Template............................................................................................................155

Log File Monitoring.......................................................................................................................156

B Automated Response for Alerts................................................................................159

Response Methods..............................................................................................................................159

How Automated Response Works in HP-UX HIDS...........................................................................160

Alert Process..................................................................................................................................160

Security Checks..............................................................................................................................160

Programming Notes......................................................................................................................160

Programming Guidelines....................................................................................................................166

Perl Versus Shell Response Scripts................................................................................................166

Writing Privileged Response Programs.........................................................................................167

Code Examples..............................................................................................................................167

Solution A.................................................................................................................................168

Code for scriptA.sh........................................................................................................168

Code for privA Program....................................................................................................168

Solution B.................................................................................................................................169

Code for privB program....................................................................................................169

Solution C.................................................................................................................................170

Code for the privC Program..............................................................................................170

Code for the scriptC.sh Script.......................................................................................170

Sample Response Programs................................................................................................................171

Sample C Language Program Source Code ..................................................................................171

Sample Shell Script Alert Responses.............................................................................................171

Forwarding Information...........................................................................................................172

Sending an Email................................................................................................................172

Logging to a Central syslog Server.....................................................................................172

Halting Further Attacks............................................................................................................173

Disabling a user's account...................................................................................................173

Disable Remote Networking...............................................................................................174

Preserving Evidence.................................................................................................................175

Putting a Process to Sleep...................................................................................................175

Snapshot of Critical System State........................................................................................176

System Restoration to a Stable state.........................................................................................177

HP OpenView Operations SMART Plug-In.......................................................................................177

OVO Enablement in HP-UX HIDS................................................................................................178

C Tuning Schedules and Generating Alert Reports...................................................179

Tuning Schedules Using the idsadmin Command.............................................................................179

Functioning of the tune Command..............................................................................................179

During Initial Deployment.......................................................................................................179

After HIDS Deployment...........................................................................................................179

Schedule Tuning Process...............................................................................................................180

Step 1: Analyzing Alerts and Tuning Schedules......................................................................180

Section Related to File Related Alerts.................................................................................181

Section Related to Aggregated Alerts.................................................................................182

Section Related to System Alerts........................................................................................182

Using the tune Command.................................................................................................183

Step 2: Modifying the Filters in the Tune Command Report...................................................183

Table of Contents 7