HP-UX Host Intrusion Detection System Version 4.4 Administrator Guide (5900-1634, April 2011)

How this template is configured
Table A-25 lists the configurable properties that this template supports.
Table 35 Failed Logins Template Properties
Default ValueTypeName
2VIIImax_failed_login
10 secondsVIfail_interval
30 secondsVIwarning_interval
root idsIIIpriv_user_list
Properties
The configurable properties are listed as follows:
max_failed_login The number of failed attempts to log in as the same user.
fail_interval The time interval over which the failed login attempts must occur to
generate an alert.
warning_interval The minimum time that must elapse before an identical failed login alert
is generated.
The default settings mean that more than two login failures for a
particular target user within 10 seconds cause an alert to be generated,
and duplicate alerts that occur within 30 seconds are not reported. It is
not an uncommon occurrence for a user to mistype a password when
attempting to log in. By modifying the values, you can customize this
template to local user behavior.
priv_user_list A high severity alert is generated when a user with a user ID or user
name in this list fails to login.
Alerts generated by this template
NOTE: Configuring of Repeated Failed Login Template is not supported for HP-UX Containers,
but can be configured for Global (init) Container.
Failed Login Attempts
Table A-26 lists the alert properties this template generates and forwards to a response program
when repeated failed logins are detected.
Table 36 Failed Login Attempts Alert Properties
DescriptionAlert Value/FormatAlert Field
Type
Alert FieldResponse Program
Argument
Unique code assigned to
template
8IntegerTemplate codeargv[1]
Template version<version>IntegerVersionargv[2]
Alert severity2 for users listed in the
priv_user_list property;
3 for all other users.
IntegerSeverityargv[3]
144 Templates and Alerts