HP-UX Host Intrusion Detection System Version 4.3 administrator guide
Table Of Contents
- HP-UX Host Intrusion Detection System Version 4.3 administrator guide
- Table of Contents
- About This Document
- 1 Introduction
- 2 Configuring HP-UX HIDS
- 3 Getting Started with HP-UX HIDS
- 4 Using the System Manager Screen
- Starting the HP-UX HIDS System Manager
- Stopping the HP-UX HIDS System Manager
- System Manager Components
- Starting HP-UX HIDS Agents
- Getting the Status of Agent Hosts
- Resynchronizing Agent Hosts
- Activating Schedules on Agent Hosts
- Stopping Schedules on Agent Hosts
- Halting HP-UX HIDS Agents
- Accessing Other Screens
- 5 Using the Schedule Manager Screen
- The Schedule Manager
- Configuring Surveillance Schedules
- Configuring Surveillance Groups
- Configuring Detection Templates
- Setting Surveillance Schedule Timetables
- Configuring Alert Aggregation
- Configuring Monitor Failed Attempts
- Configuring Duplicate Alert Suppression
- Viewing Surveillance Schedule Details
- Predefined Surveillance Schedules and Groups
- 6 Using the Host Manager Screen
- 7 Using the Network Node Screen
- 8 Using the Preferences Screen
- A Templates and Alerts
- Alert Summary
- UNIX Regular Expressions
- Limitations
- Template Property Types
- Buffer Overflow Template
- Race Condition Template
- Modification of files/directories Template
- Changes to Log File Template
- Creation and Modification of setuid/setgid File Template
- Creation of World-Writable File Template
- Modification of Another User’s File Template
- Login/Logout Template
- Repeated Failed Logins Template
- Repeated Failed su Commands Template
- Log File Monitoring Template
- B Automated Response for Alerts
- C Tuning Schedules and Generating Alert Reports
- D The Agent Configuration File
- E The Surveillance Schedule Text File
- F Error Messages
- G Troubleshooting
- Troubleshooting
- Agent and System Manager cannot communicate with each other
- Agent complains that idds has not been enabled, yet lsdev shows /dev/idds is present
- Agent does not start on system boot
- Agent halts abnormally, leaving ids_* files and message queues
- Agent host appears to hang and/or you see message disk full
- Agent needs further troubleshooting
- Agent does not start after installation
- Agents appear to be stuck in polling status
- Agent displays error if hostname to IP mapping is not registered in name service
- Aggregated alerts targets or details field are truncated and the same aggregated alert has several entries logged in the IDS_ALERTFILE
- Alert date/time sort seems inconsistent
- Alerts are not being displayed in the alert browser
- Buffer overflow triggers false positives
- Duplicate alerts appear in System Manager
- Getting several aggregated alerts for the same process
- GUI runs out of memory after receiving around 19,000 alerts
- The idsadmin Command needs installed agent certificates
- The idsadmin Command notifies of bad certificate when pinging a remote agent
- IDS_checkInstall fails with a kmtune error
- IDS_genAdminKeys or IDS_genAgentCerts does not complete successfully
- IDS_genAdminKeys or idsgui quits early
- Large files in /var/opt/ids
- Log files are filling up
- No Agent Available
- Normal operation of an application generates heavy volume of alerts
- Reflection X rlogin produces multiple login and logout alerts
- Schedule Manager timetable screen appears to hang
- SSH does not perform a clean exit after idsagent is started
- System Manager appears to hang
- System Manager does not let you save files to specific directories
- System Manager does not start after idsgui is started
- System Manager starts with no borders or title bar in X client programs on Windows
- System Manager times out on agent functions such as Activate and Status Poll
- UNKNOWN program and arguments in certain alert messages
- Using HP-UX HIDS with IPFilter and SecureShell
- Unable to Generate Administrator Keys and Agent Certificates on PA–RISC 1.1 Systems
- Troubleshooting
- H HP Software License
using the syntax described in “Type IX: Path Names / Integer Pairs” (page 120) and each
tuple is equivalent to a row in the Schedule Manager Alert Aggregation table described in
“Configuring Alert Aggregation” (page 72).
• suppression: The suppression property is a duplicate alert suppression property that
is used to enable or disable duplicate alert suppression. The property value is specified using
the syntax described in “Type VII: Flags” (page 120) and is equivalent to the Schedule Manager
Duplicate Suppression option described in “Configuring Duplicate Alert Suppression”
(page 76). The property set to 1 is equivalent to the Duplicate Alert Suppression box that
is selected in the GUI Schedule Manager. The property set to 0 is equivalent to the Duplicate
Alert Suppression box that is not selected.
• suppression_report: The suppression_report property is a duplicate alert
suppression property that enables or disables reporting of a summary of suppressed alerts.
This property is equivalent to the Schedule Manager Generate Suppression Report option
described in “Configuring Duplicate Alert Suppression” (page 76). This property when set
to 1 is equivalent to the Generate Suppression Report box that is selected in the GUI Schedule
Manager. This property when set to 0 is equivalent to the Generate Suppression Report box
that is not selected. This property is ignored if the suppression property is set to 0.
• suppression_interval: The suppression_interval property is a duplicate alert
suppression property that specifies the time (since the first suppressed duplicate alert) during
which duplicate alerts of a unique alert are suppressed. After the specified time, HIDS
generates a report summary. However, if the number of duplicate alerts exceed the number
specified in the suppression_count property (see below), a summary of duplicate alerts
can be generated earlier than the time specified in suppression_interval. This property
is equivalent to the Suppression Interval field in the GUI Schedule Manager. The default
value of this property is 6h. This means that when suppression is turned on, by default
HIDS suppresses duplicate alerts for a unique alert for 6 hours unless the number of
duplicates suppressed exceeds the number specified in the suppression_count property.
This property is ignored if the suppression property is set to 0.
• suppression_count: The suppression_count property is a duplicate alert suppression
property that specifies the number of duplicate alerts that can be suppressed within the
specified suppression interval (for a unique alert), after which, a summary of duplicate alerts
can be reported. This property is equivalent to the Suppression Count field in the GUI
Schedule Manager. The default value of this property is 100. This means that HIDS sends
a report if there are 100 or more suppressed alerts (after the first duplicate alert is suppressed)
for a unique alert within the specified suppression_interval. This property is ignored
if the suppression property is set to 0.
• suppression_targets_to_ignore: The suppression_targets_to_ignore property
is a duplicate alert suppression property that specifies the files and directories for which
duplicate alerts are not suppressed. This property is equivalent to the Suppression Targets
to Ignore field in the GUI Schedule Manager. This property is ignored if the suppression
property is set to 0. By default, duplicate alerts for the following property values (these are
interpreted as regular expressions) are not suppressed:
— ^/etc/passwd$
— ^/etc/group$
— ^/stand/vmunix$
— ^/stand/system$
— ^/\.rhosts$
— ^/etc/inetd\.conf$
• monitor_failed_attempts: This property is used to either enable or disable the
monitoring of failed attempts to create, modify, or delete critical files. The property value
is specified using the syntax described in “Type VII: Flags” (page 120) and is equivalent to
the Schedule Manager Monitor Failed Attempts To Create / Modify / Delete Critical Files option
described in “Configuring Monitor Failed Attempts” (page 75). The property set to “1” is
equivalent to the Monitor Failed Attempts To Create / Modify / Delete Critical Files option box
that is selected in the GUI Schedule Manager. The property set to "0" is equivalent to the
Surveillance Schedule Section 199