HP-UX Host Intrusion Detection System Version 4.3 administrator guide

pass in quick proto tcp from any to any port = hpidsadmin keep state
3. HP-UX HIDS System Manager uses ephemeral ports to send requests to agent host’s port
hpidsagent. Also, HP-UX HIDS agents use ephemeral ports to send responses to the
System Manager host’s port hpidsadmin.
To allow communications back to these ephemeral ports, use the “keep state” rule in
IPFilter.
pass out quick proto tcp all keep state
4. Allow queries to DNS servers by HP-UX HIDS agents and HP-UX HIDS System Manager
pass out quick proto udp all keep state
5. Since the HP-UX HIDS System Manager requires X11 connections, which can and should
be forwarded over the secure channel with SecureShell, allow SecureShell incoming
connections.
pass in quick proto tcp from any to any port = 22 flags S keep state keep frags
6. Block any incoming connections which were not explicitly allowed.
block in log quick all
How to allow the SecureShell daemon to forward X11 traffic
First, change the SecureShell /etc/opt/ssh/sshd_config configuration file:
• Set X11Forwarding to yes,
• Set X11UseLocalhost to no.
Earlier versions of ssh don’t recognize the second entry. If it’s not there, you don’t need to add
it.
Then send a HUP signal to the sshd so that it will reread the sshd_config file.
How to display System Manager after SecureShell login as root and su to ids
Problem: You use ssh to log in to a host as root, then switch to user ids and get a display error
when opening an X window or starting idsgui. Here is the terminal output:
# su ids
$ echo $DISPLAY
xyz:10.0
NOTE: xyz stands for the IP address of the host.
:10.0 is an automatic result of X11 forwarding being enabled in ssh. You should not manually
set DISPLAY to :10.0.
$ ./idsgui
Unable to display the GUI on xyz:10.0
Please check the value of the environment variable
DISPLAY and verify that this machine is authorized
to connect to that display.
If you started your ssh session with the verbose mode, -v, you will see debug messages similar
to the following. Notice the statement “X11 connection uses different authentication
protocol: ‘MIT-MAGIC-COOKIE-1’ vs. ‘’.”
xsvr3: Received X11 open request.
xsvr3: Sending open confirmation to the remote host.
xsvr3: X11 connection uses different authentication protocol:
‘MIT- MAGIC-COOKIE-1’ vs. ‘’.
X11 connection rejected because of wrong authentication at
Tue Dec 31 15:11:30 2002.
Rejected connection at Tue Dec 31 15:11:30 2002: X11 connection
from ::ffff:15.27.232.106 port 56861
xsvr3: Channel 0 closes incoming data stream.
224 Troubleshooting