HP-UX Host Intrusion Detection System Version 4.4 Administrator Guide (5900-1634, April 2011)

• “Using HP-UX HIDS with IPFilter and SecureShell” (page 218)
• “Unable to Generate Administrator Keys and Agent Certificates on PA–RISC 1.1 Systems”
(page 220)
Troubleshooting
This section describes a variety of potential problems and their solutions. To stay current with
product updates and patches, be sure to monitor the HP security software news and events web
site at www.hp.com/security.
Agent and System Manager cannot communicate with each other
(No errors are being generated by the HP-UX HIDS processes and everything seems to be running
fine otherwise.) See also “No Agent Available” (page 216).
□ Make sure the check sums on the following two files are identical:
On the Administration system, run:
/usr/bin/cksum /etc/opt/ids/certs/admin/cacert.pem
On the Agent system, run:
/usr/bin/cksum /etc/opt/ids/certs/agent/cacert.pem
If the results are different, the Administration and Agent certificates are not signed by the same
trusted certificate authority and the communication handshake fails.
To correct this, regenerate the agent certificate and install the new certificate bundle on the
agent system. Verify that the check sums match.
□ If there is a firewall positioned between the administration system and an agent system, be
sure the HP-UX HIDS ports are enabled. See “Working with Firewalls” (page 34).
□ If you are using NIS on these systems, it is likely the port information is not being retrieved
from your /etc/services file.
• Inform the NIS Master about the HP-UX HIDS ports. See “Working with NIS” (page 34).
• Launch the System Manager and verify that the agent is now available.
□ Increase the response timeout in the Preferences screen. See “General Preferences” (page 98).
□ Increase the value for IDS_SSL_TIMEOUT in the agent configuration file, ids.cf. See
“Remote Communication Configuration” (page 190).
□ If the agent system is multihomed, make sure the agent and administration systems are properly
configured. See “Configuring a Multihomed Agent System” (page 29).
□ If the administration system is multihomed, make sure the agent and administration systems
are properly configured. See “Configuring a Multihomed Administration System” (page 31).
Troubleshooting 209