HP-UX Host Intrusion Detection System Version 4.7 Administrator Guide HP-UX 11i v3 (766144-001, March 2014)

INTERFACE=127.0.0.1
7. Start the System Manager. For more information, see “Starting the HP-UX HIDS System
Manager” (page 39).
8. On the Host Manager screen, set up the administration system as an agent system, using
127.0.0.1 as its IP address. For more information, see “Adding a New Host Manually”
(page 75) and “Modifying a Host” (page 79).
Configuring Ports
When HP-UX HIDS is first installed on the administration and agent systems, the ports HP-UX HIDS
uses are configured into the /etc/services file on each system as follows:
hpidsadmin 2984/tcp #HP-UX Host IDS admin
hpidsagent 2985/tcp #HP-UX Host IDS agent
NOTE: Comments vary from configuration to configuration.
These are HP standard port numbers, registered with the Internet Assigned Number Authority
(IANA). If, for some reason you need to use different ports, you must change the numbers 2984
and 2985 in all /etc/services files on the administration system and all agent systems. If you
are working with firewalls or NIS systems, you must also make the changes as described in
“Working with NIS” and “Working with Firewalls”.
Working with NIS
If any system is using NIS, you must configure NIS to use the HP-UX HIDS communication ports.
To configure NIS to use the HP-UX HIDS communication ports, follow these steps:
1. Edit /etc/services on the NIS master server to add the two HP-UX HIDS ports described
in “Configuring Ports”.
2. Run /var/yp/ypmake on the NIS master server. For more information, see ypmake( 1M).
Working with Firewalls
If a firewall is positioned between the administration system and an agent system, enable the ports
that are used by HP-UX HIDS on the firewall. Check the values for hpidsadmin and hpidsagent in
the /etc/services file of the administration system. Configure the firewall system to allow traffic
to and from these ports. These values must be the same on all administration, agent, and firewall
systems. For more information, see “Configuring Ports”.
If you use IPFilter as your firewall, see “Using HP-UX HIDS with IPFilter and SecureShell” (page 213)
for useful configuration information for both IPFilter and SecureShell.
Enabling Multiple Agents
If you have more than about 20 agent systems, you may have to modify a kernel parameter and
a network parameter.
Enabling More than 23 Agents (Thread Limits)
You must ensure that the administration system provides enough threads per process to handle the
maximum number of agent systems you will monitor at one time. The thread value is specified by
the tunable kernel parameter max_thread_proc. You can compute its minimum value using the
following formula:
max_thread_proc = 2 * <num_agents> + 18
Where: num_agents is the number of agent systems to be monitored.
By default, max_thread_proc is set to its minimum value, 64, which allows for 23 agents. The
maximum value of max_thread_proc is governed by the configurable kernel parameter
nkthread, which you can increase if you have a larger number of agents.
Configuring Ports 31