HP-UX Host Intrusion Detection System Version 4.4 Administrator Guide (5900-1634, April 2011)

Agents
The HP-UX HIDS agent software must be running continually on the systems you are monitoring for
it to detect and report intrusions as they occur. When an agent is running a schedule, it records
intrusion alerts and agent program errors in local log files.
When the System Manager is running on the administration system, and is monitoring the agent,
alerts and errors are transferred to log files on the administration host.
In addition, agents pass alerts to user-defined programs on the agent host for analysis and action
if such programs are configured. For more information, see “Automated Response for Alerts”
(page 150).
The agent runs as a background daemon on the agent host. It communicates with the administration
host via an encrypted Secure Socket Layer (SSL) communications link, which provides integrity,
confidentiality, and authentication for network transmission.
System Manager
The HP-UX HIDS System Manager runs on the administrative system and monitors the alerts generated
by agents on the agent hosts. Use it to create surveillance schedules and download them to agents
on agent hosts.
Starting HP-UX HIDS for the First Time
This procedure describes the steps required to start the HP-UX HIDS System Manager and agents
for the first time. As you do this, your systems benefits immediately the protection of intrusion
detection while you learn the specifics of the software and tune your configuration to fit your
requirements.
Procedure 3 To Set up hosts and run schedules, follow these steps:
1. Install the agent software on the agent hosts and the System Manager software on the
administration host. For more information, see the HP-UX HIDS 4.4 release notes.
2. Create SSL certificates for the administration and agent hosts and propagate them to the host
systems. For more information, see “Setting Up HP-UX HIDS Secure Communications” (page 24).
3. Log in to each agent host as root and start the idsagent program as the ids user. For more
information, see “Starting HP-UX HIDS Agents” (page 44).
NOTE: The ids password field is set to * on installation on both agent and administration
systems, which means you cannot log in directly to ids. For security reasons, do not assign a
password to ids.
a. Login as ids.
# su ids
b. Start the agent program.
$/opt/ids/bin/idsagent
4. Log in to the administration system as root and start the System Manager as the ids user. For
more information, see “Starting the HP-UX HIDS System Manager” (page 42).
a. Login as ids:
# su ids
b. Start the System Manager program.
$/opt/ids/bin/idsgui
c. The first time you start the System Manager, the product license agreement is displayed.
This text is also printed in “HP Software License” (page 222). Click Accept to continue or
Reject if you are not ready to use the software.
38 Getting Started with HP-UX HIDS