HP-UX Host Intrusion Detection System Version 4.3 administrator guide

List of Tables
1 HP-UX 11i Releases.......................................................................................................................17
2-1 IDS Scripts Used to Set Up Secure Communications....................................................................30
2-2 Runtime File Permissions..............................................................................................................42
4-1 Monitored Nodes..........................................................................................................................50
4-2 Status Field Values.........................................................................................................................50
5-1 Predefined Surveillance Schedules...............................................................................................81
8-1 General Preferences Tab..............................................................................................................106
8-2 Alert Events Subtab.....................................................................................................................107
8-3 Error Events Subtab.....................................................................................................................108
8-4 System Manager Subtab..............................................................................................................109
A-1 Detection Templates....................................................................................................................111
A-2 Buffer Overflow Template Properties.........................................................................................122
A-3 Execute on Stack Alert Properties...............................................................................................123
A-4 Unusual Argument Length Alert Properties ..............................................................................123
A-5 Argument with Nonprintable Character Alert Properties..........................................................124
A-6 Race Condition Template Properties...........................................................................................126
A-7 File Reference Modification Alert Properties..............................................................................127
A-8 setuid Script Executed Alert Properties......................................................................................128
A-9 File/Directories Template Properties...........................................................................................130
A-10 File Being Modified Alert Properties...........................................................................................131
A-11 Failed Attempt to Modify Read-Only File Alert Properties........................................................133
A-12 Template Properties.....................................................................................................................135
A-13 Append-Only File Being Modified Alert Properties...................................................................135
A-14 Failed Attempt to Modify Append-Only File Alert Properties...................................................137
A-15 Setuid File Template Properties...................................................................................................138
A-16 Setuid File Created / Modified Alert Properties..........................................................................139
A-17 World-Writable File Template Properties....................................................................................141
A-18 World-Writable File Created Alert Properties.............................................................................142
A-19 Modification of Another User’s File Template Properties...........................................................144
A-20 Non-Owned File Being Modified Alert Properties.....................................................................145
A-21 Failed Attempt to Modify Non-Owned File Alert Properties.....................................................147
A-22 Login/Logout Template Properties..............................................................................................148
A-23 Login/Logout Alert Properties....................................................................................................149
A-24 Successful su Detected Alert Properties......................................................................................150
A-25 Failed Logins Template Properties..............................................................................................152
A-26 Failed Login Attempts Alert Properties......................................................................................152
A-27 Repeated Failed su Commands Template Properties.................................................................154
A-28 Repeated Failed Su Attempts Alert Properties...........................................................................154
A-29 Log File Monitoring Template Properties...................................................................................155
A-30 Log File Monitoring Alert Properties..........................................................................................156
B-1 Additional Arguments Passed to Response Programs for Kernel Template Alerts...................161
B-2 Additional Arguments Passed to Response Programs for Suppressed Alerts...........................162
B-3 Additional Arguments Passed to Response Programs for File Modification Failed Attempt
Alerts............................................................................................................................................163
B-4 Additional Arguments Passed to Response Programs for File Modification Failed Attempt
Alerts With DAS Enabled............................................................................................................163
B-5 Additional Arguments Passed to Response Programs for Race Condition Template Alerts.....163
B-6 Additional Arguments Passed to Response Programs for Login or Logout Alerts....................164
B-7 Additional Arguments Passed to Response Programs for su Alerts..........................................164
B-8 Additional Arguments Passed to Response Programs While Generating Aggregated Alerts....165
B-9 Environment Variables Set for Response Programs....................................................................166
11