HP Host Intrusion Detection System (HIDS) manual Appendix a 157

Page 169

 

 

 

 

 

 

Templates and Alerts

 

 

 

 

 

Creation of Setuid File Template

Table A-14

 

Setuid File Created Alert Properties (Continued)

 

 

 

 

 

 

 

 

 

Response

 

 

Alert Field

 

 

 

Program

Alert Field

Alert Value/Format

Description

 

Type

 

Argument

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

argv[8]

Details

String

“User with uid <uid> <performed

Detailed alert

 

 

 

 

 

action on> the file <full

description

 

 

 

 

 

pathname>(type=<type>,inode=<in

 

 

 

 

 

 

ode>, device<device) when

 

 

 

 

 

 

executing

 

 

 

 

 

 

<program>>(type=<type>,inode=<i

 

 

 

 

 

 

node>,device=<device>), invoked as

 

 

 

 

 

 

follows: <argv[0]> <argv[1]>..., as

 

 

 

 

 

 

process with pid <pid> and ppid

 

 

 

 

 

 

<ppid> and running with effective

 

 

 

 

 

 

uid=<euid> and with effective

 

 

 

 

 

 

gid=<egid>.

 

 

 

 

 

 

where <performed action on> is set

 

 

 

 

 

 

to one of the following:

 

 

 

 

 

 

"created the setuid file"

 

 

 

 

 

 

"changed the owner of the setuid

 

 

 

 

 

 

file"

 

 

 

 

 

 

"enabled the setuid bit on file"

 

 

 

 

 

 

"performed system call <number>

 

 

 

 

 

 

on the file"

 

 

 

 

 

 

 

 

argv[9]

Local Time

Integer

<secs>

Local time in

 

 

 

 

 

 

number of seconds

 

 

 

 

 

 

since epoch when a

 

 

 

 

 

 

privileged setuid

 

 

 

 

 

 

file is created.

 

 

 

 

 

 

 

 

 

 

Refer to Table B-1 in Appendix B for the definition of argv[10] through argv[32] that can

NOTE

 

 

 

 

be used to access specific alert information (ie., pid, ppid) without having to parse the

 

 

 

string alert fields above.

 

 

 

 

 

 

 

 

 

Limitations

• The template cannot distinguish between whether a file is created or truncated

 

when creat(2) is invoked.

Appendix A

157

Page 168 Page 170
Image 169
Page 168 Page 170
Contents Edition HP-UX Host Intrusion Detection System Administrator’s GuideManufacturing Part Number J5083-90013 December Government License WarrantyIii TrademarksConventions Contents Schedule Manager Screen System Manager ScreenNetwork Node Screen Host Manager ScreenVii Templates and Alerts Preferences ScreenViii Idsadmin Command Idsagent CommandAutomated Response Agent Configuration FileMessages TroubleshootingHP Software License Original SSLeay License HP Software License Terms Xii Overview Documentation SummaryLoss of Financial Assets Why Do You Need Intrusion Detection?Loss of Intellectual Property Loss of Computing ResourcesHow Are These Threats Realized? Who Are the Perpetrators?Misplaced Trust Malicious CodeExcessive Privilege for Simple Tasks Why Existing Tools Are Only Part of the SolutionBeing Used as a Springboard to Attack the Next Victim FirewallsSecurity Auditing Tools EncryptionWhat Is Intrusion Detection? Where Does Intrusion Detection Fit In?What HP-UX Hids Does What HP-UX Hids Does Not Do Graphic Representation HP-UX Hids ComponentsHP-UX Hids Components How the Components Interact to Detect IntrusionsDetection Templates HP-UX Hids Secure CommunicationsSurveillance Groups Surveillance SchedulesGlossary of HP-UX Hids Terms Intrusion Detection System Intrusion Detection DataKernel NodeVirus System ManagerVulnerability Glossary of HP-UX Hids Terms Chapter Configuration Configuration Required IntroductionOptional Overview of Procedures to Set Up Secure Communications Setting Up the HP-UX Hids Secure CommunicationsScript to Use Where Used End Product Create the X.509 Certificates$ IDSgenAdminKeys install $ IDSgenAgentCerts Transport the Certificates TIP$ IDSimportAgentKeys /var/opt/ids/tmp/myhost1.tar.Z myadmin Install the Keys on Each HostStep Configuring a Multihomed Agent System$ nslookup large2 ExampleTo configure a multihomed administration system Configuring a Multihomed Administration SystemEdit the agent configuration file for example To configure a loopback system Configuring a Loopback SystemWorking with NIS Configuring PortsWorking with Firewalls Enabling Over 23 Agents Thread Limits Enabling Large Numbers of AgentsTo change the value of maxthreadproc Select Kernel Configuration Select Configurable ParametersTo view and change the value of tcpconnrequestmax Enabling Over 20 Inbound RequestsRestricting Permissions Accessing ManpagesRuntime File Permissions Files PermissionsAccessing Manpages Chapter Getting Started Getting Started System Manager AgentsStarting HP-UX Hids for the First Time Set up hosts and run schedulesSee , Host Manager Screen, on Schedule Manager Operations ScreensHost Manager Network NodeSelecting Entries in Lists Basic Screen ActionsSearching Entries Sorting EntriesBasic Screen Actions Chapter System Manager Screen System Manager Screen System Manager Screen Stopping the HP-UX Hids System Manager Starting the HP-UX Hids System ManagerTo start the HP-UX Hids System Manager To stop the HP-UX Hids System ManagerStatus Field Values On the System Manager ScreenStatus Value Description To get the status of agent hosts Getting the Status of Agent HostsOn the System Manager screen To resynchronize agent hosts Resynchronizing Agent HostsTo activate a surveillance schedule on agent hosts Activating a Schedule on Agent HostsChoose the Actions Activate Schedule menu item To stop a surveillance schedule on agent hosts Stopping Schedules on Agent HostsTo start the agent Starting HP-UX Hids AgentsTo halt agents remotely from the System Manager Halting HP-UX Hids AgentsTo halt the agent locally on the agent host Go to Schedule Manager Screen Accessing Other ScreensGo to Host Manager Screen To go to the Schedule Manager screenGo to Preferences Screen Go to Network Node ScreenReturn to System Manager Screen Accessing Other Screens Chapter Schedule Manager Screen Schedule Manager Screen Schedule Manager To create a surveillance schedule Creating a Surveillance ScheduleClosing the Schedule Manager Screen Displaying the Schedule Manager ScreenTo display the Schedule Manager screen To close the Schedule Manager screenCreating a New Surveillance Schedule Configuring Surveillance SchedulesCopying a Surveillance Schedule To create a new surveillance scheduleTo modify a surveillance schedule Modifying a Surveillance ScheduleTo rename a surveillance schedule Renaming a Surveillance ScheduleChoose File Save Selected Schedule As Undoing and Redoing Changes Deleting a Surveillance ScheduleTo delete a surveillance schedule To save a surveillance schedule Saving a Surveillance ScheduleChoose File Save Selected Schedule Creating a New Surveillance Group Configuring Surveillance GroupsCopying a Surveillance Group To create a new surveillance groupTo modify a surveillance group Modifying a Surveillance GroupRename Surveillance Group Dialog Renaming a Surveillance GroupTo rename a surveillance group Saving a Surveillance Group Deleting a Surveillance GroupTo delete a surveillance group Modifying a Property Value In a Template Configuring Detection TemplatesTo change the value of a property in a detection template To add a new value Edit List Dialog11Edit Dialog Edit Suggested Best PracticesSome Template Configuration Guidelines Setting Surveillance Schedule Timetables To specify when a schedule will run Specifying When a Schedule Will RunCanceling Changes See Saving a Surveillance Schedule on Viewing the Source of a Surveillance Schedule Viewing Surveillance Schedule DetailsRefreshing the Details Display To view the source of a surveillance scheduleSaving the Details Display Clearing the Details DisplaySave Dialog To clear the displayPredefined Surveillance Schedules Predefined Surveillance Schedules and GroupsPredefined Surveillance Schedules Host Manager Screen Host Manager Screen Displaying the Host Manager Screen Managing HostsClosing the Host Manager Screen Adding a New Host Manually Adding New HostsAdd Host Dialog To add a new host manuallyAddress field Host NameIP Address Name field Adding New Hosts from /etc/hostsHost Name and IP Address To add new hosts from /etc/hostsRules for Host Lists Files Adding New Hosts from a FileOpen Dialog To add new hosts from a fileTo modify a host entry Modifying a HostTo delete a host entry Deleting HostsEnabling and Disabling Hosts To enable or disable an agent host for monitoringAdd, modify or delete tags To add a tag Managing TagsTo delete a tag To edit a tagSaving the Host List in the Current File Maintaining Host FilesSaving the Host List in a Different File Using Multiple Host Files Using an Alternate Host List FileMaintaining Host Files Chapter Network Node Screen 100 Opening a Network Node Screen Network Node ScreenClosing a Network Node Screen To display the Network Node screen for an agent host102 Alerts TabHP-UX Hids Alerts What They Mean, What to Do HP-UX Hids Errors What They Mean, What to Do Errors Tab104 Selecting Entries General OperationsSelecting with the Mouse Simple VersionSearching for a String Searching for the Next Unseen EntryFind Dialog Deleting an Entry To delete one or more alerts or errorsMarking Entries as Seen or Unseen To search again108 UnseenNetwork Node screen from the System Manager screen Saving a Log File SetSaving the Current Log File Set Saving a New Log File SetPress Ctrl-A Save Dialog BoxExample Creating a New File Set Example Saving the File Set over Another File SetLog File Rotation Opening a Log File SetOpen Dialog Box 112 Preferences Screen 114 Preferences Screen General Preferences Option Default DescriptionTo choosing Actions Status Poll from the System Manager 116Actions Resync from the System Manager screen Browser Preferences Column Name Default DescriptionAlert Events Preferences 118Column Default Description Name Error Events Preferences120 System Manager SubtabTemplates and Alerts Limitations AlertsProperty Types TemplatesTable A-1 Detection Templates Alert SummaryAttack Detected Alert Alert Severity Detection Template 124 Appendix a 125 Examples Unix Regular Expressions126 Appendix a 127 128 LimitationsType I Pathnames to Not Monitor Template Property Types130 Type II Pathnames/Programs PairsType IV UID Pairs Type III UIDsType VI Time Strings Type V Network Triplets132 Type Viii Scalars Type VII Flags134 Buffer Overflow TemplateExecute on Stack Name Type Default ValueTable A-2 Template Properties Table A-3 Execute on Stack Alert Properties136 Table A-4 Unusual Argument Length Alert Properties Unusual Argument Length138 Argument with Non-printable CharacterAppendix a 139 140 Table A-6 Template Properties Race Condition TemplateTable A-7 File Reference Modification Alert Properties File Reference Modification142 Appendix a 143 Table A-8 Setuid Script Executed Alert Properties Privileged Setuid Script Executed144 Appendix a 145 Table A-9 Template Properties Modification of Files/Directories Template146 Properties 148 Table A-10 File Being Modified Alert Properties File Being Modified150 Appendix a 151 Table A-11 Template Properties Changes to Log File Template152 Table A-12 Append-Only File Being Modified Alert Properties Append-Only File Being Modified154 Table A-13 Template Properties Creation of Setuid File TemplateAlerts generated By this templateTable A-14 Setuid File Created Alert Properties Setuid File Created156 Appendix a 157 Table A-15 Template Properties Creation of World-Writable File Template158 Table A-16 World-writable File Created Alert Properties World-Writable File Created160 Appendix a 161 162 Table A-17 Template Properties Modification of Another User’s File TemplateTable A-18 Non-owned File Being Modified Alert Properties Non-owned File Being Modified164 Appendix a 165 Limitations 166 Table A-19 Template Properties Login/Logout Template168 Table A-20 Login/Logout Alert Properties Login/LogoutTable A-21 Successful su Detected Alert Properties Successful su Detected170 Appendix a 171 172 Table A-22 Template Properties Repeated Failed Logins TemplateTemplate How this template Table A-23 Failed Login Attempts Alert Properties Failed Login Attempts174 Appendix a 175 Repeated Failed su Attempts Repeated Failed su Commands TemplateTable A-24 Template Properties Table A-25 Repeated Failed Su Attempts Alert PropertiesAppendix a 177 178 Template Configuration SyntaxAppendix a 179 180 Automated Response 182 Response Methods General Guidelines184 Alert Process How Automated Response Works in HP-UX HidsSecurity checks Programming Notes186 Table B-1 Additional Arguments Passed to Response ProgramsAppendix B 187 Name Value Description Table B-3 Environment Variables Set for Response Programs188 Appendix B 189 Writing Perl vs. Shell Response Scripts Programming GuidelinesWriting Privileged Response Programs 190Code Examples Solution aCode for scriptA.sh Code for privA program Solution BCode for PrivB program 192Solution C Code for scriptC.sh script #!/usr/bin/sh Code for privC program194 Sample C Language Program Source Code Sample Response ProgramsSample Shell Script Alert Responses 196 Forwarding InformationAppendix B 197 198 Halting any further attacksAppendix B 199 200 Preservation of evidenceAppendix B 201 202 Restoration of a known good stateHP OpenView Operations Smart Plug-In OVO Enablement in HP-UX Hids204 Idsagent Command 206 Synopsis Options Idsagent Command208 ExampleIdsadmin Command 210 Synopsis Startup Options Idsadmin Command212 CommandsAgent Configuration File 214 Forcing Active Agent to Reread Configuration File Agent Configuration FileGlobal Configuration Name Default ValueTable E-1 Global Configuration Variables 216Kernel Audit Data DSP Data Source Process ConfigurationTable E-2 DSP idskernDSP Parameters218 Table E-3 Remote Communication ConfigurationCorrelator Configuration Variables 220 Messages 222 Agent Messages Idsagent internal error in handling signature groups Idsagent failed to reopen stderr in append modeIdsagent failed to initialize configuration module Idsagent failed to start groupIdsagent unable to setup Sighup signal handler Idsagent unable to setup Sigchld signal handlerIdsagent unable to setup signal handler Idsagent unable to setup Sigsegv signal handlerIdsagent failed to allocate memory Idsagent error trying to shutdown a processIdsagent failed to create schedule path filename Idsagent failed to execute correlator corrIdsagent internal error occurred in PMStopGroup Idsagent internal error no correlator in PMStartProcessesIdsagent failed to initialize schedule Idsagent failed to initialize schedule in crontabIdsagent not enough disk space to parse schedule Idsagent not enough disk space to create scheduleIdsagent not enough disk space to save config file Idsagent out of process table spaceInternal error unknown state Internal errorUnable to open the response script directory dir System Manager Messages Incomplete or Invalid Entry Data Entry Error Exception while opening file filename File Save ErrorInvalid Host State Unable to disable host Invalid Property Value value Property Value ErrorOnly one property may be edited at a time Selection Error No more instances of searchstring found Find ErrorSearchstring not found Find Error Select Property to be edited Selection ErrorSelect Surveillance Group to copy Selection Error Select Surveillance Group Name to delete Selection ErrorSelect Surveillance Schedule to copy Selection Error Select Surveillance Schedule to delete Selection ErrorFollowing hosts are in an invalid state for this command Surveillance Schedule not selected Schedule Selection ErrorUnable to Overwrite filename File Save Error 234Unknown IP Address unable to resolve Host Name Unknown Host unable to resolve IP Address IPaddress236 Troubleshooting 238 Appendix G 239 Agent and System Manager cannot communicate with each other Troubleshooting240 $ /usr/sbin/kmtune -q enableidds Agent does not start on system bootTo clean up the IDS message queues Agent needs further troubleshootingAgent host appears to hang and/or you see message disk full 242Agents appear to be stuck in polling status Agent does not start after installationAlert date/time sort seems inconsistent Alerts are not being displayed in the alert browserBuffer overflow triggers false positives Idsadmin needs installed agent certificatesDuplicate alerts appear in System Manager 244IDSgenAdminKeys or idsgui quits early IDScheckInstall fails with a kmtune errorLog files are filling up Large files in /var/opt/idsNo Agent Available 246Schedule Manager timetable screen appears to hang SSH does not perform a clean exit after idsgent is startedSystem Manager does not start after idsgui is started System Manager appears to hang248 Unknown program and arguments in certain alert messages Using HP-UX Hids with IPFilter and SecureShellIPFilter rules for HP-UX Hids 250 How to allow the SecureShell daemon to forward X11 trafficAppendix G 251 252 Appendix H 253 HP Software License254 OpenSSL LicenseAppendix H 255 Original SSLeay License256 HP Software License Terms 258
Related manuals
Manual 55 pages 31.55 Kb Manual 20 pages 7.92 Kb
Top Page Image Contents