HP-UX Host Intrusion Detection System Version 4.3 administrator guide

System Manager starts with no borders or title bar in X client programs on Windows
□ This sometimes happens when Reflection X (or other X client programs on Microsoft
Windows) has been running for a while. Quit, restart the program, relogin to your HP-UX
HIDS administration system, and restart the System Manager. If the problem persists, contact
HP support.
System Manager times out on agent functions such as Activate and Status Poll
□ This may be the result of one of these problems: (1) idsagent has hung, (2) idsagent has
died or is not responding properly, or (3) the System Manager is expecting responses back
from the idsagent too quickly.
• If idsagent appears to have hung, restart idsagent. See “Forcing Active Agent to
Reread Configuration File” (page 191).
• If the idsagent has died, then restart it. See “Starting HP-UX HIDS Agents” (page 51).
• If the System Manager seems to be expecting responses back too quickly, then increasing
the Agent Response Timeout value may help alleviate the problem. See “General
Preferences” (page 105).
UNKNOWN program and arguments in certain alert messages
Sometimes, alerts occur specifying an UNKNOWN program and arguments. For example:
uid=-1, gid=-1, pid=-1, ppid=-1 file=/dev/dlpi,
type=4, mode=8630, uid=0, gid=3, inode=128,
device=1073741827 Non-owned file being modified
User with uid 0 opened for modificati on/truncation
/dev/dlpi (type=4,inode=128,device=1073741827)
(owned by user with uid 0) when executing UNKNOWN,
invoked with UNKNOWN arguments, as process with
p id 22125 and ppid 22124 and running with
effective uid=101 and with effective gid=10
See “Limitations” (page 115) for details.
Using HP-UX HIDS with IPFilter and SecureShell
The HP-UX implementation of the IPFilter firewall system can be configured to allow
communication among the HP-UX HIDS administration and agent systems. IPFilter is a stateful
system that maintains the state of communications across multiple packets or that monitors
(proxies) an entire TCP/UDP session.
This section contains a sample set of the IPFilter rules that are needed to enable communication
among the HP-UX HIDS components. The IPFilter configuration for HP-UX HIDS can be helpful
for configuring another vendor’s firewall to allow proper communication among the HP-UX
HIDS components.
IPFilter rules for HP-UX HIDS
This is a sample set of IPFilter rules needed to enable HP-UX HIDS. If you use a firewall other
than IPFilter, the explanation presented here should give you enough pointers to set up your
own firewall rules.
1. HP-UX HIDS agent listens on port hpidsagent (2985) for incoming connections initiated
by HP-UX HIDS System Manager on a remote host.
So if the host running IPFilter is also running an HP-UX HIDS agent, then allow incoming
connections initiated by HP-UX HIDS System Manager.
pass in quick proto tcp from any to any port = hpidsagent keep state
2. HP-UX HIDS System Manager listens on port hpidsadmin (2984) for incoming connections
initiated by HP-UX HIDS agents.
If the host running IPFilter is also running an HP-UX HIDS System Manager, then allow
incoming connections initiated by HP-UX HIDS agents.
Troubleshooting 223