HP-UX Host Intrusion Detection System Version 4.3 administrator guide

1. Determine if the agent system is multihomed. Use the nslookup command to determine
which IP address corresponds to the host name of the system. If more than one IP address
is returned by nslookup, your system is multihomed. If only one IP address is returned,
your system is not multihomed.
NOTE: No modifications are needed for a system that has only one IP address.
2. Select the interface on which you want the HP-UX HIDS agent to communicate with the
administration system.
The choice of address depends on your network topology. The address can be an IP address
in IPv4 dotted decimal notation, (for example, 1.2.3.4) or an IP address in IPv6 colon notation,
(for example, 2001:db8::100) or a host name that resolves to a unique address on the system
where the agent resides.
It is essential that a network route exists between the HP-UX HIDS administration system
and the HP-UX HIDS agent system. On the administration system, enter the
/usr/sbin/ping command or the /usr/contrib/bin/traceroute command to verify
that network traffic can flow between the systems. HP recommends that you select the
address with the shortest transmission speed or fewer hops (exposure).
Later, you must enter the IP address or host name you selected into a configuration screen
in the HP-UX HIDS System Manager. For more information see Chapter 6 (page 83).
NOTE: If the HP-UX HIDS agent system uses an IPv4 address for communication, the
administration system must also use an IPv4 address. This is also applicable for the IPv6
address.
3. On the multihomed agent host, log in as ids, as follows:
$su - ids
4. Edit the configuration file; for example:
$ vi /etc/opt/ids/ids.cf
5. Locate the IDS_LISTEN_IFACE parameter in the Globals section. For more information,
see Appendix D (page 191)
6. Remove the comment symbol (#) from the start of the line, and place the interface address
selected in step 2 after the parameter name. For example, change:
# IDS_LISTEN_IFACE <insert your hostname/IP addr here>
to
IDS_LISTEN_IFACE 192.0.2.4
or
IDS_LISTEN_IFACE 2001:db8::100
7. Save the modified file.
8. If the agent is running, force the agent to reread the configuration file by sending it a HUP
signal. For more information, see “Forcing Active Agent to Reread Configuration File”
(page 191).
If you enter an invalid IDS_LISTEN_IFACE parameter, the HP-UX HIDS software agent reports
an error when you attempt to start it. Repeat steps 1to 8 to correct the setting of
IDS_LISTEN_IFACE, and restart the HP-UX HIDS agent.
Example
The following example illustrates how to configure a multihomed agent system:
36 Configuring HP-UX HIDS