HP-UX Host Intrusion Detection System Version 4.3 administrator guide

NOTE: If an HP-UX HIDS agent system, with which the administration system has to
communicate, uses an IPv4 address for communication, the administration system must
also use an IPv4 address to communicate with that agent. To communicate with IPv6 address
agent system, the administration system must also use an IPv6 address. To communicate
with the IPv4 and IPv6 agents, the administration system must have both IPv4 and IPv6
address configured.
The choice of address depends on your network topology. The address can either be an IPv4
address in dotted decimal notation (for example, 192.0.2.4) or an IPv6 address in colon
notation (for example 2001:db8::100) or a host name that resolves to a unique address on
the system where the agent resides.
It is essential that a network route exist between the HP-UX HIDS administration system
and HP-UX HIDS agent systems. On the administration system, use the /usr/sbin/ping
command or the /usr/contrib/bin/traceroute command to verify that network
traffic can flow between the systems. You can select the address with the shortest transmission
speed or fewer hops (exposure).
NOTE: A different administration system is required to monitor agents that are on a
different (physically separated) network, even if an administration system is connected to
both networks. This is because an administration system can only monitor agents that are
on the same network.
3. On the multihomed administration host, log in as ids, as follows:
$ su - ids
4. Edit the System Manager script, as follows:
$ vi /opt/ids/bin/idsgui
5. Locate the INTERFACE variable in the GUI Configuration section. For more information,
see idsgui(1M).
6. Add your interface address selected in Step 2 after the equals sign. For example, change:
INTERFACE=
to
INTERFACE=192.0.2.4
or
INTERFACE=2001:db8::100
NOTE: To communicate with IPv4 and IPv6 agents, specify the IPv6 wildcard address as
follows:
INTERFACE=::
7. Save the file with your modifications.
8. If the System Manager is running, stop and restart it.
9. On each agent host, log in as ids, as follows:
$ su - ids
10. Edit the agent configuration file, as follows:
$ vi /etc/opt/ids/ids.cf
11. Locate the REMOTEHOST parameter in the [RemoteSA] section. For more information, see
ids.cf(4).
12. Add your interface address (IP address or host name) selected in Step 2. For example, change:
38 Configuring HP-UX HIDS