HP-UX Host Intrusion Detection System Version 4.7 Administrator Guide HP-UX 11i v3 (766144-001, March 2014)

System Manager starts with no borders or title bar in X client programs on Windows
□ This sometimes happens when Reflection X (or other X client programs on Microsoft Windows)
has been running for a while. Quit, restart the program, relogin to your HP-UX HIDS
administration system, and restart the System Manager. If the problem persists, contact HP
support.
System Manager times out on agent functions such as Activate and Status Poll
□ This may be the result of one of these problems: (1) idsagent has hung, (2) idsagent has
died or is not responding properly, or (3) the System Manager is expecting responses back
from the idsagent too quickly.
• If idsagent appears to have hung, restart idsagent. See “Forcing Active Agent to
Reread Configuration File” (page 182).
• If the idsagent has died, then restart it. See “Starting HP-UX HIDS Agents” (page 41).
• If the System Manager seems to be expecting responses back too quickly, then increasing
the Agent Response Timeout value may help alleviate the problem. See “General
Preferences” (page 94).
UNKNOWN program and arguments in certain alert messages
Sometimes, alerts occur specifying an UNKNOWN program and arguments. For example:
uid=-1, gid=-1, pid=-1, ppid=-1 file=/dev/dlpi,
type=4, mode=8630, uid=0, gid=3, inode=128,
device=1073741827 Non-owned file being modified
User with uid 0 opened for modificati on/truncation
/dev/dlpi (type=4,inode=128,device=1073741827)
(owned by user with uid 0) when executing UNKNOWN,
invoked with UNKNOWN arguments, as process with
p id 22125 and ppid 22124 and running with
effective uid=101 and with effective gid=10
See “Limitations” (page 105) for details.
Using HP-UX HIDS with IPFilter and SecureShell
The HP-UX implementation of the IPFilter firewall system can be configured to allow communication
among the HP-UX HIDS administration and agent systems. IPFilter is a stateful system that maintains
the state of communications across multiple packets or that monitors (proxies) an entire TCP/UDP
session.
This section contains a sample set of the IPFilter rules that are needed to enable communication
among the HP-UX HIDS components. The IPFilter configuration for HP-UX HIDS can be helpful for
configuring another vendor’s firewall to allow proper communication among the HP-UX HIDS
components.
IPFilter rules for HP-UX HIDS
This is a sample set of IPFilter rules needed to enable HP-UX HIDS. If you use a firewall other than
IPFilter, the explanation presented here should give you enough pointers to set up your own firewall
rules.
1. HP-UX HIDS agent listens on port hpidsagent (2985) for incoming connections initiated by
HP-UX HIDS System Manager on a remote host.
So if the host running IPFilter is also running an HP-UX HIDS agent, then allow incoming
connections initiated by HP-UX HIDS System Manager.
Troubleshooting 213