HP-UX Host Intrusion Detection System Version 4.7 Administrator Guide HP-UX 11i v3 (766144-001, March 2014)

How this template addresses the vulnerability
The Login/Logout template monitors the start and end of interactive user sessions. Specifically, this
template monitors sulog, wtmps on HP-UX 11i v2 and HP-UX 11i v3 for the following:
• Successful remote logins with utmp records are logged in utmp
• Logouts
• Successful su commands to switch to another user name
How this template is configured
You can configure this template to monitor only logins, only logouts, or only su attempts, to monitor
all of them, or to monitor a subset of them. For example, logins and su but not logouts.
You can configure the Login/Logout template to generate an alert if someone begins an interactive
session using a privileged user account, such as adm, bin, sys, root, or ids, and to ignore all other
users.
You can also configure the template to ignore logins and logouts by a small set of users who are
expected to be on the system during certain time periods, and to generate alerts for all other users.
For example, on a database server, only the user dbmaint is expected to log in during a specified
maintenance period. No other users are expected to be using the system during that period. The
template can be configured to generate an alert at the start and end of remote connections by all
users during the maintenance period except for the dbmaint user.
Table 32 Login/Logout Template Properties
Default ValueTypeProperty
<empty>IIIusers_to_ignore
<empty>IIIusers_to_monitor
1VIImonitor_su_flag
1VIImonitor_login_flag
1VIImonitor_logout_flag
<empty>Vip_filters
root | idsIIIpriv_user_list
NOTE: The users_to_monitor property takes precedence over users_to_ignore when
both lists are set. If users_to_monitor is not empty, values in users_to_ignore are ignored.
The configurable properties are listed as follows:
users_to_ignore Users in this list allow those users to log in, log out and su without
generating an alert.
users_to_monitor Alerts are generated when users with a user ID or user name in this
list log in, log out or use the su command if the corresponding
monitor_*_flag is set to 1.
monitor_su_flag When set to 1, the template monitors successful su attempts to users
specified in users_to_monitor or, if users_to_monitor is
empty, by users not listed in users_to_ignore.
monitor_login_flag When set to 1, the template monitors successful logins to users
specified in users_to_monitor or, if users_to_monitor is
empty, by users not listed in users_to_ignore.
monitor_logout_flag When set to 1, the template monitors successful logouts by users
specified in users_to_monitor or, if users_to_monitor is
empty, by users not listed in users_to_ignore.
138 Templates and Alerts