HP-UX Host Intrusion Detection System Version 4.3 administrator guide

1. To view the current value, enter the following command:
# ndd -get /dev/tcp tcp_conn_request_max
If this value is 20, or some number smaller than the number of agent systems, then proceed
to Step 2 and adjust it to the number of agents you plan to monitor, or greater.
2. To change the value, log in as root and modify the /etc/rc.config.d/nddconf
configuration file by adding the following lines:
TRANSPORT_NAME[index]=tcp
NDD_NAME[index]=tcp_conn_request_max
NDD_VALUE[index]=value
Where:
• index is a shell array index, as described in the file,
• value is the value to be assigned.
For example, if this is the first entry in the file and you want to set the value of
tcp_conn_request_max to 4096 enter the following:
TRANSPORT_NAME[0]=tcp
NDD_NAME[0]=tcp_conn_request_max
NDD_VALUE[0]=4096
The new value is applied on the next system boots.
3. To apply the new value immediately, enter the following command:
# ndd -c /etc/rc.config.d/nddconf
To verify that the new value is active, use the ndd -get command as described in Step 1.
Restricting Permissions
HP-UX HIDS files and programs are delivered with the strictest usable permissions. Only user
ids is allowed any access, and the superuser (root) is not permitted to execute the programs.
In addition, most files must be owned by user ids or HP-UX HIDS cannot run.
Table 2-2 lists the proper runtime permissions.
Table 2-2 Runtime File Permissions
PermissionsFiles
u=rw (octal value 600)Configuration files in /etc/opt/ids
u=rw (octal value 600)Data files in /var/opt/ids
u=rx (octal value 500)Program and other files in /opt/ids
u=rwx (octal value 700)Directories, such as/var/opt/ids
42 Configuring HP-UX HIDS