HP-UX Host Intrusion Detection System Version 4.3 administrator guide

echo “Critical intrusion: halting process ${pid} running ${24} that modified
/etc/passwd”
/usr/bin/mailx -s “$7” ${RECIPIENT}
kill -KILL ${pid}
fi
fi
# Exit with no error
exit 0
Sample Response Programs
The following sections contain examples of C and shell script response programs.
Sample C Language Program Source Code
This is a sample C language source code for a response program. It is available in /opt/ids/
share/examples/ids_alertResponse.c.
Modify the source code below to take appropriate action in response to intrusions. This source
code can be compiled with a standard C compiler. For information on arguments and environment
variables, see Table B-1 (page 161), Table B-9 (page 166) and Appendix A (page 111).
Example B-1 Response Program
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char **argv) {
#if 0 /* insert your response code here */
int i;
for(i=0; i < argc; i++) {
fprintf(stderr, "argv[%d] = %s n", i, argv[i]);
}
#endif
exit(0);
}
Sample Shell Script Alert Responses
IMPORTANT: Some of these sample shell scripts require root privileges. It must not be run as
setuid root. These scripts are for illustrative purposes only. Having a privileged setuid shell
script on your system makes it vulnerable to a well known race condition attack, which enables
a nonprivileged user to easily acquire a root shell and gain complete control of the system.
For shell scripts that require root privilege, follow the instructions in “Writing Privileged Response
Programs” (page 167).
Sample Response Programs 171