HP-UX Host Intrusion Detection System Version 4.7 Administrator Guide HP-UX 11i v3 (766144-001, March 2014)

• “Using HP-UX HIDS with IPFilter and SecureShell” (page 213)
• ???
Troubleshooting
This section describes a variety of potential problems and their solutions. To stay current with
product updates and patches, be sure to monitor the HP security software news and events web
site at www.hp.com/security.
Agent and System Manager cannot communicate with each other
(No errors are being generated by the HP-UX HIDS processes and everything seems to be running
fine otherwise.) See also “No Agent Available” (page 211).
□ Make sure the check sums on the following two files are identical:
On the Administration system, run:
/usr/bin/cksum /etc/opt/ids/certs/admin/cacert.pem
On the Agent system, run:
/usr/bin/cksum /etc/opt/ids/certs/agent/cacert.pem
If the results are different, the Administration and Agent certificates are not signed by the same
trusted certificate authority and the communication handshake fails.
To correct this, regenerate the agent certificate and install the new certificate bundle on the
agent system. Verify that the check sums match.
□ If there is a firewall positioned between the administration system and an agent system, be
sure the HP-UX HIDS ports are enabled. See “Working with Firewalls” (page 31).
□ If you are using NIS on these systems, it is likely the port information is not being retrieved
from your /etc/services file.
• Inform the NIS Master about the HP-UX HIDS ports. See “Working with NIS” (page 31).
• Launch the System Manager and verify that the agent is now available.
□ Increase the response timeout in the Preferences screen. See “General Preferences” (page 94).
□ Increase the value for IDS_SSL_TIMEOUT in the agent configuration file, ids.cf. See
“Remote Communication Configuration” (page 186).
□ If the agent system is multihomed, make sure the agent and administration systems are properly
configured. See “Configuring a Multihomed Agent System” (page 26).
□ If the administration system is multihomed, make sure the agent and administration systems
are properly configured. See “Configuring a Multihomed Administration System” (page 28).
204 Troubleshooting