HP-UX Host Intrusion Detection System Version 4.3 administrator guide

Agents
The HP-UX HIDS agent software must be running continually on the systems you are monitoring
for it to detect and report intrusions as they occur. When an agent is running a schedule, it records
intrusion alerts and agent program errors in local log files.
When the System Manager is running on the administration system, and is monitoring the agent,
alerts and errors are transferred to log files on the administration host.
In addition, agents pass alerts to user-defined programs on the agent host for analysis and action
if such programs are configured. For more information, see “Automated Response for Alerts”
(page 159).
The agent runs as a background daemon on the agent host. It communicates with the
administration host via an encrypted Secure Socket Layer (SSL) communications link, which
provides integrity, confidentiality, and authentication for network transmission.
System Manager
The HP-UX HIDS System Manager runs on the administrative system and monitors the alerts
generated by agents on the agent hosts. Use it to create surveillance schedules and download
them to agents on agent hosts.
Starting HP-UX HIDS for the First Time
This procedure describes the steps required to start the HP-UX HIDS System Manager and agents
for the first time. As you do this, your systems benefits immediately the protection of intrusion
detection while you learn the specifics of the software and tune your configuration to fit your
requirements.
Procedure 3-2 To Set up hosts and run schedules, follow these steps:
1. Install the agent software on the agent hosts and the System Manager software on the
administration host. For more information, see the HP-UX HIDS 4.3 release notes.
2. Create SSL certificates for the administration and agent hosts and propagate them to the
host systems. For more information, see “Setting Up HP-UX HIDS Secure Communications”
(page 29).
3. Log in to each agent host as root and start the idsagent program as the ids user. For
more information, see “Starting HP-UX HIDS Agents” (page 51).
NOTE: The ids password field is set to * on installation on both agent and administration
systems, which means you cannot log in directly to ids. For security reasons, do not assign
a password to ids.
a. Login as ids.
# su ids
b. Start the agent program.
$/opt/ids/bin/idsagent
44 Getting Started with HP-UX HIDS