HP-UX Host Intrusion Detection System Version 4.3 administrator guide
Table Of Contents
- HP-UX Host Intrusion Detection System Version 4.3 administrator guide
- Table of Contents
- About This Document
- 1 Introduction
- 2 Configuring HP-UX HIDS
- 3 Getting Started with HP-UX HIDS
- 4 Using the System Manager Screen
- Starting the HP-UX HIDS System Manager
- Stopping the HP-UX HIDS System Manager
- System Manager Components
- Starting HP-UX HIDS Agents
- Getting the Status of Agent Hosts
- Resynchronizing Agent Hosts
- Activating Schedules on Agent Hosts
- Stopping Schedules on Agent Hosts
- Halting HP-UX HIDS Agents
- Accessing Other Screens
- 5 Using the Schedule Manager Screen
- The Schedule Manager
- Configuring Surveillance Schedules
- Configuring Surveillance Groups
- Configuring Detection Templates
- Setting Surveillance Schedule Timetables
- Configuring Alert Aggregation
- Configuring Monitor Failed Attempts
- Configuring Duplicate Alert Suppression
- Viewing Surveillance Schedule Details
- Predefined Surveillance Schedules and Groups
- 6 Using the Host Manager Screen
- 7 Using the Network Node Screen
- 8 Using the Preferences Screen
- A Templates and Alerts
- Alert Summary
- UNIX Regular Expressions
- Limitations
- Template Property Types
- Buffer Overflow Template
- Race Condition Template
- Modification of files/directories Template
- Changes to Log File Template
- Creation and Modification of setuid/setgid File Template
- Creation of World-Writable File Template
- Modification of Another User’s File Template
- Login/Logout Template
- Repeated Failed Logins Template
- Repeated Failed su Commands Template
- Log File Monitoring Template
- B Automated Response for Alerts
- C Tuning Schedules and Generating Alert Reports
- D The Agent Configuration File
- E The Surveillance Schedule Text File
- F Error Messages
- G Troubleshooting
- Troubleshooting
- Agent and System Manager cannot communicate with each other
- Agent complains that idds has not been enabled, yet lsdev shows /dev/idds is present
- Agent does not start on system boot
- Agent halts abnormally, leaving ids_* files and message queues
- Agent host appears to hang and/or you see message disk full
- Agent needs further troubleshooting
- Agent does not start after installation
- Agents appear to be stuck in polling status
- Agent displays error if hostname to IP mapping is not registered in name service
- Aggregated alerts targets or details field are truncated and the same aggregated alert has several entries logged in the IDS_ALERTFILE
- Alert date/time sort seems inconsistent
- Alerts are not being displayed in the alert browser
- Buffer overflow triggers false positives
- Duplicate alerts appear in System Manager
- Getting several aggregated alerts for the same process
- GUI runs out of memory after receiving around 19,000 alerts
- The idsadmin Command needs installed agent certificates
- The idsadmin Command notifies of bad certificate when pinging a remote agent
- IDS_checkInstall fails with a kmtune error
- IDS_genAdminKeys or IDS_genAgentCerts does not complete successfully
- IDS_genAdminKeys or idsgui quits early
- Large files in /var/opt/ids
- Log files are filling up
- No Agent Available
- Normal operation of an application generates heavy volume of alerts
- Reflection X rlogin produces multiple login and logout alerts
- Schedule Manager timetable screen appears to hang
- SSH does not perform a clean exit after idsagent is started
- System Manager appears to hang
- System Manager does not let you save files to specific directories
- System Manager does not start after idsgui is started
- System Manager starts with no borders or title bar in X client programs on Windows
- System Manager times out on agent functions such as Activate and Status Poll
- UNKNOWN program and arguments in certain alert messages
- Using HP-UX HIDS with IPFilter and SecureShell
- Unable to Generate Administrator Keys and Agent Certificates on PA–RISC 1.1 Systems
- Troubleshooting
- H HP Software License
How this template addresses the vulnerability
The Login/Logout template monitors the start and end of interactive user sessions. Specifically,
this template monitors sulog, wtmps on HP-UX 11i v2 and HP-UX 11i v3 for the following:
• Successful remote logins with utmp records are logged in utmp
• Logouts
• Successful su commands to switch to another user name
How this template is configured
You can configure this template to monitor only logins, only logouts, or only su attempts, to
monitor all of them, or to monitor a subset of them. For example, logins and su but not logouts.
You can configure the Login/Logout template to generate an alert if someone begins an interactive
session using a privileged user account, such as adm, bin, sys, root, or ids, and to ignore all other
users.
You can also configure the template to ignore logins and logouts by a small set of users who are
expected to be on the system during certain time periods, and to generate alerts for all other
users. For example, on a database server, only the user dbmaint is expected to log in during a
specified maintenance period. No other users are expected to be using the system during that
period. The template can be configured to generate an alert at the start and end of remote
connections by all users during the maintenance period except for the dbmaint user.
Table A-22 Login/Logout Template Properties
Default ValueTypeProperty
<empty>III
users_to_ignore
<empty>III
users_to_monitor
1VII
monitor_su_flag
1VII
monitor_login_flag
1VII
monitor_logout_flag
<empty>V
ip_filters
root | idsIII
priv_user_list
NOTE: The users_to_monitor property takes precedence over users_to_ignore when
both lists are set. If users_to_monitor is not empty, values in users_to_ignore are ignored.
The configurable properties are listed as follows:
users_to_ignore Users in this list allow those users to log in, log out and su without
generating an alert.
users_to_monitor
Alerts are generated when users with a user ID or user name in
this list log in, log out or use the su command if the corresponding
monitor_*_flag is set to 1.
monitor_su_flag When set to 1, the template monitors successful su attempts to
users specified in users_to_monitor or, if users_to_monitor
is empty, by users not listed in users_to_ignore.
monitor_login_flag
When set to 1, the template monitors successful logins to users
specified in users_to_monitor or, if users_to_monitor is
empty, by users not listed in users_to_ignore.
monitor_logout_flag
When set to 1, the template monitors successful logouts by users
specified in users_to_monitor or, if users_to_monitor is
empty, by users not listed in users_to_ignore.
148 Templates and Alerts