HP-UX Host Intrusion Detection System Version 4.3 administrator guide

How this template is configured
Table A-25 lists the configurable properties that this template supports.
Table A-25 Failed Logins Template Properties
Default ValueTypeName
2VIII
max_failed_login
10 secondsVI
fail_interval
30 secondsVI
warning_interval
root ids
III
priv_user_list
Properties
The configurable properties are listed as follows:
max_failed_login
The number of failed attempts to log in as the same user.
fail_interval
The time interval over which the failed login attempts must occur to
generate an alert.
warning_interval
The minimum time that must elapse before an identical failed login
alert is generated.
The default settings mean that more than two login failures for a
particular target user within 10 seconds cause an alert to be generated,
and duplicate alerts that occur within 30 seconds are not reported. It
is not an uncommon occurrence for a user to mistype a password when
attempting to log in. By modifying the values, you can customize this
template to local user behavior.
priv_user_list
A high severity alert is generated when a user with a user ID or user
name in this list fails to login.
Alerts generated by this template
Failed Login Attempts
Table A-26 lists the alert properties this template generates and forwards to a response program
when repeated failed logins are detected.
Table A-26 Failed Login Attempts Alert Properties
DescriptionAlert Value/FormatAlert Field
Type
Alert FieldResponse Program
Argument
Unique code assigned to
template
8IntegerTemplate codeargv[1]
Template version<version>IntegerVersionargv[2]
Alert severity2 for users listed in the
priv_user_list property;
3 for all other users.
IntegerSeverityargv[3]
UTC time in number of
seconds since the epoch
when
<max_failed_login>
number of failed logins
were detected for a
particular target login
account
<secs>
IntegerUTC Timeargv[4]
152 Templates and Alerts