HP UX Bastille Software IPFilter.blocknetrange, IPFilter.blockping, IPFilter.blockSecureShell

can result in attacks that go undetected and reports of many false alerts. HIDS will work but your system may still be vulnerable.

•Prevent the onset of attacks. If your system is vulnerable to attacks, those vulnerabilities will remain even after HIDS is installed.

•Find static security flaws on a system. For example, if the password file contained an illegitimate account before HIDS was installed, that illegitimate account remains a vulnerability even after HIDS is installed and operational. Furthermore, HIDS cannot authenticate users of a valid account. For example, if users share password information, HIDS cannot ascertain the identity of an unauthorized user gaining access to a system via a legitimate account login.

Actions	Enable incoming network traffic for this service by adding the following lines
	to the /etc/opt/ipf/ipf.conf file when actively managed by HP-UX
	Bastille:
	# do allow hpidsagent incoming connections
	pass in quick proto tcp from any to any port = hpidsagent flags S keep state
	keep frags

IPFilter.block_netrange

Headline	Allow additional incoming network traffic from a select list of IP addresses.
Default	192.168.1.0/255.255.255.0 10.10.10.10
Description	The basic IPFilter rules setup by HP-UX Bastille only allow network traffic for
	services associated with software that HP-UX Bastille recognizes as installed
	on the system. All other incoming traffic is blocked by default. To allow
	additional incoming traffic based on the IP address of the sending host, enter
	specific IP addresses here with an optional netmask. Otherwise, answer 'N'.
Actions	Enable incoming network traffic for select hosts by adding the following lines
	to the /etc/opt/ipf/ipf.conf file when actively managed by HP-UX
	Bastille:
	# Allow incoming connections from the following select IP
	addresses:
	pass in quick from <ip>/<netmask> to any

IPFilter.block_ping

Headline	BLOCK incoming ICMP echo requests with IPFilter.
Default	Y
Description	ICMP echo or ping is used for device discovery for a number of applications,
	including System Insight Manager, and OpenView Network node manager.
	Though this is commonly used by hackers to discover hosts, the information
	returned to them is minimal. Past vulnerablities of ping are patched. For this
	reason, you should block incoming icmp-echo requests if you do not need
	management applications to discover the device.
Actions	Enable incoming network traffic for this service by adding the following lines
	to the /etc/opt/ipf/ipf.conf file when actively managed by HP-UX
	Bastille:
	# do allow ping incoming connections
	pass in quick proto icmp from any to any icmp-type

IPFilter.block_SecureShell

Headline	BLOCK incoming Secure Shell connections with IPFilter.
Default	N
Description	Secure Shell is the best replacement for Telnet, remote shell, and FTP. It is
	authenticated and encrypted. If you want remote access to your machine, this

47