HP Host Intrusion Detection System (HIDS) Type V Network Triplets, Type VI Time Strings, 132

Page 144

Templates and Alerts

Template Property Types

if the ﬁle’s owner’s UID is 16, and the effective UID of the modifying process is 2 then no alarm is triggered.

Type V: Network Triplets

The values for this property type consist of network information triplets. The members of a triplet are as follows:

•IP address: An IP address. For IPv4 the address must be in standard dot notation; for IPv6, in colon notation.

•Network mask: The network mask value qualiﬁes the value in the IP address ﬁeld to an individual host address or a network address. A value of 255.255.255.255 means the value in the IP address ﬁeld is an individual host address; otherwise, it is a network address. The network mask follows the notational requirements for IP addresses.

•Severity code: An integer representing a severity level (0=No Alert, 1=critical,

2=severe, 3=moderate), where a severity level of 0 speciﬁes that no alert should be generated for a matching {IP address, Network Mask, 0} triplet.

The following template conﬁguration command line gives an example for this type of property value:

ip_filters 192.168.0.2, 255.255.255.255, 1 \

192.168.20.0, 255.255.255.0, 0

Type VI: Time Strings

Time strings are strings that represent time intervals. Each time string has the following syntax:

integer [units]

The integer component is a positive integer, representing a time interval. The units component, when present, indicates the time units that integer is expressed in. The following units are supported:

•s:Seconds

•m: Minutes

•h: Hours

•d: Days

•w: Weeks

When the units component is not present, the integer component is assumed to be in units of seconds. For example, the following lines in the template conﬁguration ﬁle:

fail_interval 23

warning_interval 10m

fail_interval 1h

warning_interval 23s

contain time strings representing values of 23 seconds, 10 minutes, 1 hour and 23 seconds; the s component in the last line is redundant, but can be used for clarity.

132	Appendix A

Image 144

Contents HP-UX Host Intrusion Detection System Administrator’s Guide EditionManufacturing Part Number J5083-90013 December Warranty Government LicenseTrademarks IiiConventions Contents System Manager Screen Schedule Manager ScreenHost Manager Screen Network Node ScreenVii Preferences Screen Templates and AlertsViii Idsagent Command Idsadmin CommandAutomated Response Agent Conﬁguration FileTroubleshooting MessagesHP Software License Original SSLeay License HP Software License Terms Xii Overview Summary DocumentationWhy Do You Need Intrusion Detection? Loss of Financial AssetsLoss of Intellectual Property Loss of Computing ResourcesWho Are the Perpetrators? How Are These Threats Realized?Misplaced Trust Malicious CodeWhy Existing Tools Are Only Part of the Solution Excessive Privilege for Simple TasksBeing Used as a Springboard to Attack the Next Victim FirewallsEncryption Security Auditing ToolsWhere Does Intrusion Detection Fit In? What Is Intrusion Detection?What HP-UX Hids Does What HP-UX Hids Does Not Do HP-UX Hids Components Graphic RepresentationHow the Components Interact to Detect Intrusions HP-UX Hids ComponentsHP-UX Hids Secure Communications Detection TemplatesSurveillance Groups Surveillance SchedulesGlossary of HP-UX Hids Terms Intrusion Detection Data Intrusion Detection SystemKernel NodeSystem Manager VirusVulnerability Glossary of HP-UX Hids Terms Chapter Conﬁguration Conﬁguration Introduction RequiredOptional Setting Up the HP-UX Hids Secure Communications Overview of Procedures to Set Up Secure CommunicationsScript to Use Where Used End Product Create the X.509 Certiﬁcates$ IDSgenAdminKeys install $ IDSgenAgentCerts TIP Transport the CertiﬁcatesInstall the Keys on Each Host $ IDSimportAgentKeys /var/opt/ids/tmp/myhost1.tar.Z myadminConﬁguring a Multihomed Agent System StepExample $ nslookup large2Conﬁguring a Multihomed Administration System To conﬁgure a multihomed administration systemEdit the agent conﬁguration ﬁle for example Conﬁguring a Loopback System To conﬁgure a loopback systemConﬁguring Ports Working with NISWorking with Firewalls Enabling Large Numbers of Agents Enabling Over 23 Agents Thread LimitsTo change the value of maxthreadproc Select Kernel Conﬁguration Select Conﬁgurable ParametersEnabling Over 20 Inbound Requests To view and change the value of tcpconnrequestmaxAccessing Manpages Restricting PermissionsRuntime File Permissions Files PermissionsAccessing Manpages Chapter Getting Started Getting Started Agents System ManagerSet up hosts and run schedules Starting HP-UX Hids for the First TimeSee , Host Manager Screen, on Operations Screens Schedule ManagerHost Manager Network NodeBasic Screen Actions Selecting Entries in ListsSearching Entries Sorting EntriesBasic Screen Actions Chapter System Manager Screen System Manager Screen System Manager Screen Starting the HP-UX Hids System Manager Stopping the HP-UX Hids System ManagerTo start the HP-UX Hids System Manager To stop the HP-UX Hids System ManagerOn the System Manager Screen Status Field ValuesStatus Value Description Getting the Status of Agent Hosts To get the status of agent hostsOn the System Manager screen Resynchronizing Agent Hosts To resynchronize agent hostsActivating a Schedule on Agent Hosts To activate a surveillance schedule on agent hostsChoose the Actions Activate Schedule menu item Stopping Schedules on Agent Hosts To stop a surveillance schedule on agent hostsStarting HP-UX Hids Agents To start the agentHalting HP-UX Hids Agents To halt agents remotely from the System ManagerTo halt the agent locally on the agent host Accessing Other Screens Go to Schedule Manager ScreenGo to Host Manager Screen To go to the Schedule Manager screenGo to Network Node Screen Go to Preferences ScreenReturn to System Manager Screen Accessing Other Screens Chapter Schedule Manager Screen Schedule Manager Screen Schedule Manager Creating a Surveillance Schedule To create a surveillance scheduleDisplaying the Schedule Manager Screen Closing the Schedule Manager ScreenTo display the Schedule Manager screen To close the Schedule Manager screenConﬁguring Surveillance Schedules Creating a New Surveillance ScheduleCopying a Surveillance Schedule To create a new surveillance scheduleModifying a Surveillance Schedule To modify a surveillance scheduleRenaming a Surveillance Schedule To rename a surveillance scheduleChoose File Save Selected Schedule As Deleting a Surveillance Schedule Undoing and Redoing ChangesTo delete a surveillance schedule Saving a Surveillance Schedule To save a surveillance scheduleChoose File Save Selected Schedule Conﬁguring Surveillance Groups Creating a New Surveillance GroupCopying a Surveillance Group To create a new surveillance groupModifying a Surveillance Group To modify a surveillance groupRenaming a Surveillance Group Rename Surveillance Group DialogTo rename a surveillance group Deleting a Surveillance Group Saving a Surveillance GroupTo delete a surveillance group Conﬁguring Detection Templates Modifying a Property Value In a TemplateTo change the value of a property in a detection template Edit List Dialog To add a new valueSuggested Best Practices 11Edit Dialog EditSome Template Conﬁguration Guidelines Setting Surveillance Schedule Timetables Specifying When a Schedule Will Run To specify when a schedule will runCanceling Changes See Saving a Surveillance Schedule on Viewing Surveillance Schedule Details Viewing the Source of a Surveillance ScheduleRefreshing the Details Display To view the source of a surveillance scheduleClearing the Details Display Saving the Details DisplaySave Dialog To clear the displayPredeﬁned Surveillance Schedules and Groups Predeﬁned Surveillance SchedulesPredeﬁned Surveillance Schedules Host Manager Screen Host Manager Screen Managing Hosts Displaying the Host Manager ScreenClosing the Host Manager Screen Adding New Hosts Adding a New Host ManuallyAdd Host Dialog To add a new host manuallyHost Name Address ﬁeldIP Address Adding New Hosts from /etc/hosts Name ﬁeldHost Name and IP Address To add new hosts from /etc/hostsAdding New Hosts from a File Rules for Host Lists FilesOpen Dialog To add new hosts from a ﬁleModifying a Host To modify a host entryDeleting Hosts To delete a host entryTo enable or disable an agent host for monitoring Enabling and Disabling HostsManaging Tags Add, modify or delete tags To add a tagTo edit a tag To delete a tagMaintaining Host Files Saving the Host List in the Current FileSaving the Host List in a Different File Using an Alternate Host List File Using Multiple Host FilesMaintaining Host Files Chapter Network Node Screen 100 Network Node Screen Opening a Network Node ScreenClosing a Network Node Screen To display the Network Node screen for an agent hostAlerts Tab 102HP-UX Hids Alerts What They Mean, What to Do Errors Tab HP-UX Hids Errors What They Mean, What to Do104 General Operations Selecting EntriesSelecting with the Mouse Simple VersionSearching for the Next Unseen Entry Searching for a StringFind Dialog To delete one or more alerts or errors Deleting an EntryMarking Entries as Seen or Unseen To search againUnseen 108Saving a Log File Set Network Node screen from the System Manager screenSaving the Current Log File Set Saving a New Log File SetSave Dialog Box Press Ctrl-AExample Creating a New File Set Example Saving the File Set over Another File SetOpening a Log File Set Log File RotationOpen Dialog Box 112 Preferences Screen 114 Preferences Screen Option Default Description General PreferencesTo choosing Actions Status Poll from the System Manager 116Actions Resync from the System Manager screen Column Name Default Description Browser PreferencesAlert Events Preferences 118Error Events Preferences Column Default Description NameSystem Manager Subtab 120Templates and Alerts Alerts LimitationsProperty Types TemplatesAlert Summary Table A-1 Detection TemplatesAttack Detected Alert Alert Severity Detection Template 124 Appendix a 125 Unix Regular Expressions Examples126 Appendix a 127 Limitations 128Template Property Types Type I Pathnames to Not MonitorType II Pathnames/Programs Pairs 130Type III UIDs Type IV UID PairsType V Network Triplets Type VI Time Strings132 Type VII Flags Type Viii ScalarsBuffer Overﬂow Template 134Name Type Default Value Execute on StackTable A-2 Template Properties Table A-3 Execute on Stack Alert Properties136 Unusual Argument Length Table A-4 Unusual Argument Length Alert PropertiesArgument with Non-printable Character 138Appendix a 139 140 Race Condition Template Table A-6 Template PropertiesFile Reference Modiﬁcation Table A-7 File Reference Modiﬁcation Alert Properties142 Appendix a 143 Privileged Setuid Script Executed Table A-8 Setuid Script Executed Alert Properties144 Appendix a 145 Modiﬁcation of Files/Directories Template Table A-9 Template Properties146 Properties 148 File Being Modiﬁed Table A-10 File Being Modiﬁed Alert Properties150 Appendix a 151 Changes to Log File Template Table A-11 Template Properties152 Append-Only File Being Modiﬁed Table A-12 Append-Only File Being Modiﬁed Alert Properties154 Creation of Setuid File Template Table A-13 Template PropertiesAlerts generated By this templateSetuid File Created Table A-14 Setuid File Created Alert Properties156 Appendix a 157 Creation of World-Writable File Template Table A-15 Template Properties158 World-Writable File Created Table A-16 World-writable File Created Alert Properties160 Appendix a 161 162 Modiﬁcation of Another User’s File Template Table A-17 Template PropertiesNon-owned File Being Modiﬁed Table A-18 Non-owned File Being Modiﬁed Alert Properties164 Appendix a 165 Limitations 166 Login/Logout Template Table A-19 Template Properties168 Login/Logout Table A-20 Login/Logout Alert PropertiesSuccessful su Detected Table A-21 Successful su Detected Alert Properties170 Appendix a 171 172 Repeated Failed Logins Template Table A-22 Template PropertiesTemplate How this template Failed Login Attempts Table A-23 Failed Login Attempts Alert Properties174 Appendix a 175 Repeated Failed su Commands Template Repeated Failed su AttemptsTable A-24 Template Properties Table A-25 Repeated Failed Su Attempts Alert PropertiesAppendix a 177 Template Conﬁguration Syntax 178Appendix a 179 180 Automated Response 182 General Guidelines Response Methods184 How Automated Response Works in HP-UX Hids Alert ProcessSecurity checks Programming NotesTable B-1 Additional Arguments Passed to Response Programs 186Appendix B 187 Table B-3 Environment Variables Set for Response Programs Name Value Description188 Appendix B 189 Programming Guidelines Writing Perl vs. Shell Response ScriptsWriting Privileged Response Programs 190Solution a Code ExamplesCode for scriptA.sh Solution B Code for privA programCode for PrivB program 192Solution C Code for privC program Code for scriptC.sh script #!/usr/bin/sh194 Sample Response Programs Sample C Language Program Source CodeSample Shell Script Alert Responses Forwarding Information 196Appendix B 197 Halting any further attacks 198Appendix B 199 Preservation of evidence 200Appendix B 201 Restoration of a known good state 202OVO Enablement in HP-UX Hids HP OpenView Operations Smart Plug-In204 Idsagent Command 206 Idsagent Command Synopsis OptionsExample 208Idsadmin Command 210 Idsadmin Command Synopsis Startup OptionsCommands 212Agent Conﬁguration File 214 Agent Conﬁguration File Forcing Active Agent to Reread Conﬁguration FileName Default Value Global ConﬁgurationTable E-1 Global Conﬁguration Variables 216Data Source Process Conﬁguration Kernel Audit Data DSPTable E-2 DSP idskernDSP Parameters218 Remote Communication Conﬁguration Table E-3Correlator Conﬁguration Variables 220 Messages 222 Agent Messages Idsagent failed to reopen stderr in append mode Idsagent internal error in handling signature groupsIdsagent failed to initialize conﬁguration module Idsagent failed to start groupIdsagent unable to setup Sigchld signal handler Idsagent unable to setup Sighup signal handlerIdsagent unable to setup signal handler Idsagent unable to setup Sigsegv signal handlerIdsagent error trying to shutdown a process Idsagent failed to allocate memoryIdsagent failed to create schedule path ﬁlename Idsagent failed to execute correlator corrIdsagent internal error no correlator in PMStartProcesses Idsagent internal error occurred in PMStopGroupIdsagent failed to initialize schedule Idsagent failed to initialize schedule in crontabIdsagent not enough disk space to create schedule Idsagent not enough disk space to parse scheduleIdsagent not enough disk space to save conﬁg ﬁle Idsagent out of process table spaceInternal error Internal error unknown stateUnable to open the response script directory dir System Manager Messages Exception while opening ﬁle filename File Save Error Incomplete or Invalid Entry Data Entry ErrorInvalid Host State Unable to disable host Invalid Property Value value Property Value ErrorNo more instances of searchstring found Find Error Only one property may be edited at a time Selection ErrorSearchstring not found Find Error Select Property to be edited Selection ErrorSelect Surveillance Group Name to delete Selection Error Select Surveillance Group to copy Selection ErrorSelect Surveillance Schedule to copy Selection Error Select Surveillance Schedule to delete Selection ErrorSurveillance Schedule not selected Schedule Selection Error Following hosts are in an invalid state for this commandUnable to Overwrite filename File Save Error 234Unknown Host unable to resolve IP Address IPaddress Unknown IP Address unable to resolve Host Name236 Troubleshooting 238 Appendix G 239 Troubleshooting Agent and System Manager cannot communicate with each other240 Agent does not start on system boot $ /usr/sbin/kmtune -q enableiddsAgent needs further troubleshooting To clean up the IDS message queuesAgent host appears to hang and/or you see message disk full 242Agent does not start after installation Agents appear to be stuck in polling statusAlert date/time sort seems inconsistent Alerts are not being displayed in the alert browserIdsadmin needs installed agent certiﬁcates Buffer overﬂow triggers false positivesDuplicate alerts appear in System Manager 244IDScheckInstall fails with a kmtune error IDSgenAdminKeys or idsgui quits earlyLarge ﬁles in /var/opt/ids Log ﬁles are ﬁlling upNo Agent Available 246SSH does not perform a clean exit after idsgent is started Schedule Manager timetable screen appears to hangSystem Manager appears to hang System Manager does not start after idsgui is started248 Using HP-UX Hids with IPFilter and SecureShell Unknown program and arguments in certain alert messagesIPFilter rules for HP-UX Hids How to allow the SecureShell daemon to forward X11 trafﬁc 250Appendix G 251 252 HP Software License Appendix H 253OpenSSL License 254Original SSLeay License Appendix H 255256 HP Software License Terms 258

Related manuals

Manual 55 pages 31.55 Kb

Manual 20 pages 7.92 Kb