HP-UX Host Intrusion Detection System Version 4.3 administrator guide

NOTE: The pathnames below are suggested places to store files. However, they are not delivered
as part of HP-UX HIDS, because of the program's security policy implications.
Solution A
/opt/ids/response/
scriptA.sh
A non-setuid script with mode 500 and owned by ids:ids
/opt/ids/response/misc A directory with mode 500, owned by ids:ids.
/opt/ids/response/misc/
privA
A setuid-root program with mode 4550, owned by
root:ids
Code for scriptA.sh
#!/usr/bin/sh
## Sample HP-UX HIDS alert response script
## Stop a process that has performed an intrusive activity.
RESPONSE_BASE=$IDS_BASE/rt_response
RECIPIENT=”root”
# Sets the umask to a “sane” value
umask 077
# If there is a file modification alert
if [ $1 = “2” ]
then
# and if the target of the attack is the password file
if [ ${17} = “/etc/passwd” ]; then
# obtain the process ID from the alert
pid=${11}
echo “Critical intrusion: halting process ${pid} running ${24}
that modified /etc/passwd” | /usr/bin/mailx -s “$7” $
{RECIPIENT}
# Invoke setuid-root program to kill process instead
# of using a setuid-root script that is susceptible to # race
condition attacks.
${RESPONSE_BASE}/misc/privA ${pid}
fi
fi
# Exit with no error
exit 0
Code for privA Program
#include <signal.h>
#include <stdlib.h>
int main(int argc, char **argv)
{
int pid;
if (argc != 2) exit(1);
if ((pid = strtol(argv[1], (char **)NULL, 10)) == 0)
exit(1);
if (kill((pid_t)pid,SIGKILL) == -1) {
perror(“kill”);
exit(1);
}
fprintf(stderr,”Successfully killed offending process %d n” ,pid);
168 Automated Response for Alerts