HP-UX Host Intrusion Detection System Version 4.3 administrator guide

Table of Contents
About This Document.......................................................................................................15
Intended Audience................................................................................................................................15
New and Changed Information in This Edition...................................................................................15
Publishing History................................................................................................................................15
Document Organization.......................................................................................................................15
Typographic Conventions.....................................................................................................................16
HP-UX Release Name and Release Identifier.......................................................................................17
Related Information..............................................................................................................................17
HP Welcomes Your Comments.............................................................................................................17
1 Introduction...................................................................................................................19
Importance of Intrusion Detection........................................................................................................19
Who are the Perpetrators?...............................................................................................................19
How are These Threats Realized?...................................................................................................20
Misplaced Trust..........................................................................................................................20
Malicious Code...........................................................................................................................20
Strong Security with a Weak Link..............................................................................................20
Exploitation of Critical Infrastructure Elements........................................................................20
Misconfigured Software and Hardware....................................................................................20
Excessive Privileges for Simple Tasks........................................................................................20
Springboards to Attack the Next Target....................................................................................21
Existing Tools Are Only Part of the Solution...................................................................................21
Firewalls.....................................................................................................................................21
Encryption..................................................................................................................................21
Security Auditing Tools..............................................................................................................22
Intrusion Detection Technology......................................................................................................22
HP-UX HIDS Functionality..................................................................................................................23
HP-UX HIDS Limitations................................................................................................................23
HP-UX HIDS Components...................................................................................................................24
HP-UX HIDS Secure Communications...........................................................................................26
Glossary of HP-UX HIDS Terms...........................................................................................................26
2 Configuring HP-UX HIDS.............................................................................................29
Required Configuration Steps..............................................................................................................29
Optional Configuration Steps...............................................................................................................29
Setting Up HP-UX HIDS Secure Communications..............................................................................29
Configuring a Multihomed Agent System...........................................................................................35
Example...........................................................................................................................................36
Configuring a Multihomed Administration System............................................................................37
Changing the IP Address of an Administration System.................................................................39
Configuring a Loopback System...........................................................................................................39
Configuring Ports..................................................................................................................................40
Working with NIS............................................................................................................................40
Working with Firewalls...................................................................................................................40
Enabling Multiple Agents.....................................................................................................................40
Enabling More than 23 Agents (Thread Limits)..............................................................................40
Enabling More than 20 Inbound Requests......................................................................................41
Restricting Permissions.........................................................................................................................42
Table of Contents 3