HP-UX Host Intrusion Detection System Version 4.3 administrator guide

1
Higher severity if specified by the severity template property or the log_severity_def global property. For
more information about the severity property, see “Log File Monitoring Template”. For more information about
the log_severity_def global property, see “Surveillance Schedule Section”
2
Higher severity if specified by an ip_filter property. For more information about the ip_filter property, see
“Login/Logout Template” (page 147).
UNIX Regular Expressions
UNIX regular expressions are supported to specify template directory and file properties.
Template properties that specify path names (for example, pathnames_to_watch,
pathnames_to_not_watch, pathnames_X, programs_X) are interpreted as UNIX regular
expressions. For a description of regular expressions and pattern matching notations, see regexp(
5). To match a specific file, use the anchor characters ^ and $ (for example, ^/etc/passwd$).
To match any file in a particular directory, use the ^ anchor character and a trailing backslash
(for example,^/stand/).
NOTE: You must correctly specify path names using regular expressions. For instance, if the
regular expression /var/t.* is changed to /var/t*, then the new regular expression matches
any path name that contains the substring /var/, because the * operator matches 0 or more
occurrences of the t character. Similarly, if the regular expression ^/opt/ is changed to /opt,
the new regular expression is significantly different and much more encompassing. The regular
expression /opt matches any path name that contains the /opt substring, including those path
names that do not start with /opt, such as /dir1/opt2/file1.
The following examples illustrate the UNIX regular expressions:
• The regular expression /home matches any file that contains /home in its path name, such
as /dir1/home, /dir1/hometown, /dir1/home2, and /home2/file1.
• The regular expression ^/home matches any file with a path name that starts with /home,
such as /hometown,/home/file1, and/home2/file2.
• The regular expression ^/home/ matches any file under the /home directory, such as /home/
file1 and /home/dir1/file2.
• The regular expression ^/home$ exactly matches the /home directory or file.
• The regular expression /.rhosts matches any file on the system that contains a slash
followed by any character that is then followed by rhosts, such as /dir1/arhosts,
/1rhosts, /.rhosts, and /home/<user>/.rhosts.
• The regular expression /\.rhosts$ matches any .rhosts file on the system, such as
/.rhosts and/home/<user>/.rhosts. Using the backslash character escapes the special
dot (.) character.
• The regular expression ^/\.rhosts$ exactly matches the .rhosts file in the root directory.
• The regular expression ^/home/[^/]*/\.rhosts$ matches all the /.rhosts files in the
home directories.
NOTE: The special pattern-matching scheme in previous versions of HIDS is no longer
supported.
When you attempt to match the pipe (|), ampersand (&), or comma (,) characters in a regular
expression, you must escape those special characters using a backslash (\) character, because
these three characters also have special meaning, they are used as delimiters by the parser of the
template property syntax. For example, a path name of a\|b has the backslash removed by the
template property parser before being passed as a regular expression to the regular expression
parser (for example, as a|b). To match a path name that contains one of these three characters,
you must escape the backslash and the special character itself. For example, a\\\|b passes to
the regular expression parser as a\|b). When including a bracket expression (for example,
[a-z,A-Z,0-9]) in a regular expression, any commas in the bracket expression must be escaped.
114 Templates and Alerts