HP-UX Host Intrusion Detection System Version 4.3 administrator guide

5. Edit the System Manager script, as follows:
$ vi /opt/ids/bin/idsgui
6. Set the value of INTERFACE in idsgui to the following:
INTERFACE=127.0.0.1
7. Start the System Manager. For more information, see “Starting the HP-UX HIDS System
Manager” (page 49).
8. On the Host Manager screen, set up the administration system as an agent system, using
127.0.0.1 as its IP address. For more information, see “Adding a New Host Manually”
(page 84) and “Modifying a Host” (page 88).
Configuring Ports
When HP-UX HIDS is first installed on the administration and agent systems, the ports HP-UX
HIDS uses are configured into the /etc/services file on each system as follows:
hpidsadmin 2984/tcp #HP-UX Host IDS admin
hpidsagent 2985/tcp #HP-UX Host IDS agent
NOTE: Comments vary from configuration to configuration.
These are HP standard port numbers, registered with the Internet Assigned Number Authority
(IANA). If, for some reason you need to use different ports, you must change the numbers 2984
and 2985 in all /etc/services files on the administration system and all agent systems. If you
are working with firewalls or NIS systems, you must also make the changes as described in
“Working with NIS” and “Working with Firewalls”.
Working with NIS
If any system is using NIS, you must configure NIS to use the HP-UX HIDS communication
ports. To configure NIS to use the HP-UX HIDS communication ports, follow these steps:
1. Edit /etc/services on the NIS master server to add the two HP-UX HIDS ports described
in “Configuring Ports”.
2. Run /var/yp/ypmake on the NIS master server. For more information, see ypmake( 1M).
Working with Firewalls
If a firewall is positioned between the administration system and an agent system, enable the
ports that are used by HP-UX HIDS on the firewall. Check the values for hpidsadmin and
hpidsagent in the /etc/services file of the administration system. Configure the firewall
system to allow traffic to and from these ports. These values must be the same on all
administration, agent, and firewall systems. For more information, see “Configuring Ports”.
If you use IPFilter as your firewall, see “Using HP-UX HIDS with IPFilter and SecureShell”
(page 223) for useful configuration information for both IPFilter and SecureShell.
Enabling Multiple Agents
If you have more than about 20 agent systems, you may have to modify a kernel parameter and
a network parameter.
Enabling More than 23 Agents (Thread Limits)
You must ensure that the administration system provides enough threads per process to handle
the maximum number of agent systems you will monitor at one time. The thread value is specified
by the tunable kernel parameter max_thread_proc. You can compute its minimum value using
the following formula:
40 Configuring HP-UX HIDS