HP-UX Host Intrusion Detection System Version 4.3 administrator guide

How Automated Response Works in HP-UX HIDS
This section discusses how the response programs handle the agent alerts.
Alert Process
When the agent generates an alert, the following actions occur:
1. The agent stores the alert in a local log file with a path name defined by the IDS_ALERTFILE
configuration variable. The default is /var/opt/ids/alert.log. For information, see
“The Agent Configuration File” (page 191).
2. If it is communicating with the System Manager, the agent sends the alert to the System
Manager.
3. The agent looks for executable files in the directory defined by the IDS_RESPONSE_DIR
configuration variable. The default directory is /opt/ids/response. For more information,
see “The Agent Configuration File” (page 191)
The agent can execute up to 50 files. If there are more than 50 files in the
IDS_RESPONSE_DIR, the agent selects 50 ordinary files each time an alert is generated and
ignores the rest.
4. For each executable file, the agent sets certain environment variables and passes the alert
details as command-line parameters.
5. The agent executes the files one at a time in ASCII sorted order, but does not wait for them
to terminate.
NOTE: When alert aggregation is enabled, only aggregated alerts and alerts that are not
or cannot be aggregated follow the alert process above. For more information about alert
aggregation, see “Configuring Alert Aggregation” (page 72).
The alert process does not apply to the additional real-time alerts that are issued when both
the alert aggregation and the real-time alerts options are enabled. These additional real time
alerts are not logged to IDS_ALERTFILE and are not sent to the System Manager. Instead,
they are only sent to any response programs in the directory defined by the
IDS_RT_RESPONSE_DIR configuration variable. The default directory is /opt/ids/
rt_response.
Security Checks
The following rules apply to the response directory and its files:
□ If the response directory fails these checks, then no response program is run.
• The directory must not be world-writable, that is, not writable by others.
• The directory must be owned by user ids.
• The directory must be local; it cannot be a symbolic link, a pipe, NFS-mounted, and so
on.
□ If a response program fails these checks, it is not run.
• A file in the response directory must be a local regular file; it cannot be a symbolic link,
a pipe, NFS-mounted, and so on.
• A file in the response directory must not be world-writable.
Programming Notes
1. Response programs run with the same user ID as the HP-UX HIDS agent. While this is not
a privileged user ID, you can modify and delete HP-UX HIDS files using this ID. Pay attention
to security issues when planning alert response design.
2. Response programs are detached from a controlling terminal and runs as a background
process. Standard output and standard error are both redirected to the error log file, as
defined by the IDS_ERRORFILE configuration variable. The default is /var/opt/ids/
error.log.
160 Automated Response for Alerts