HP Host Intrusion Detection System (HIDS) manual Agent does not start after installation

Page 255

Troubleshooting

Troubleshooting

•/opt/ids/bin/idsagent -d -e -l /var/log/idslog

❏The debug information can be found in the following ﬁles:

•/var/log/idslog

•/var/log/idslog_idskerndsp

•/var/log/idslog_idssysdsp

•/var/log/idslog_idscor

Agent does not start after installation

❏Verify that there are no errors from the install: /var/adm/sw/swagent.log

❏Be sure the product has been run as user ids. (No other user will work.)

❏Verify that all keys have been generated as described in “Setting Up the HP-UXHIDS Secure Communications” on page 20.

❏Run /opt/ids/bin/IDS_checkInstall to verify that all required patches have been installed properly prior to installing IDS. IDS_checkInstall should be run on an OS where IDS is installed. If patches are missing, uninstall IDS (swremove), install the patches (see the Release Notes cited in “Documentation” on page 2), and reinstall IDS (swinstall).

Agents appear to be stuck in polling status

In some instances, the combination of the autostatus and autosync processes leave some agents in “polling” status. The workaround is to use autostatus only or to perform a manual status to get the agent display into a known state.

Alert date/time sort seems inconsistent

❏Two factors come into play in this seeming inconsistency: First, the agent’s date/time stamp is based on the local host time when the alert was received. Second, the time the System Manager uses to sort the alert is based on the UTC when the alert actually occurred. Under normal circumstances, these two times are identical. On occasion, however, there may be a difference depending on internal processing time, which may make the alert list inconsistent.

Alerts are not being displayed in the alert browser

❏Check to see if they are appearing in /var/opt/ids/alert.log.

❏Check for errors in the error browser.

❏Determine whether IDDS failed at boot-up: Use the /etc/dmesg command to verify that there are no messages saying, IDDS disabled.

❏Verify that the host name and IP address are conﬁgured and valid.

❏In the event that the keys have become corrupted, regenerate all key sets using procedures from “Setting Up the HP-UX HIDS Secure Communications” on page 20.

❏Verify that the agent system is set to “Running” (with a green background) in the System Manager.

Appendix G

243

Image 255

Contents HP-UX Host Intrusion Detection System Administrator’s Guide EditionManufacturing Part Number J5083-90013 December Government License WarrantyIii TrademarksConventions Contents Schedule Manager Screen System Manager ScreenHost Manager Screen Network Node ScreenVii Preferences Screen Templates and AlertsViii Agent Conﬁguration File Idsagent CommandIdsadmin Command Automated ResponseTroubleshooting MessagesHP Software License Original SSLeay License HP Software License Terms Xii Overview Documentation SummaryLoss of Computing Resources Why Do You Need Intrusion Detection?Loss of Financial Assets Loss of Intellectual PropertyMalicious Code Who Are the Perpetrators?How Are These Threats Realized? Misplaced TrustFirewalls Why Existing Tools Are Only Part of the SolutionExcessive Privilege for Simple Tasks Being Used as a Springboard to Attack the Next VictimSecurity Auditing Tools EncryptionWhat Is Intrusion Detection? Where Does Intrusion Detection Fit In?What HP-UX Hids Does What HP-UX Hids Does Not Do Graphic Representation HP-UX Hids ComponentsHP-UX Hids Components How the Components Interact to Detect IntrusionsSurveillance Schedules HP-UX Hids Secure CommunicationsDetection Templates Surveillance GroupsGlossary of HP-UX Hids Terms Node Intrusion Detection DataIntrusion Detection System KernelSystem Manager VirusVulnerability Glossary of HP-UX Hids Terms Chapter Conﬁguration Conﬁguration Introduction RequiredOptional Create the X.509 Certiﬁcates Setting Up the HP-UX Hids Secure CommunicationsOverview of Procedures to Set Up Secure Communications Script to Use Where Used End Product$ IDSgenAdminKeys install $ IDSgenAgentCerts Transport the Certiﬁcates TIP$ IDSimportAgentKeys /var/opt/ids/tmp/myhost1.tar.Z myadmin Install the Keys on Each HostStep Conﬁguring a Multihomed Agent System$ nslookup large2 ExampleTo conﬁgure a multihomed administration system Conﬁguring a Multihomed Administration SystemEdit the agent conﬁguration ﬁle for example To conﬁgure a loopback system Conﬁguring a Loopback SystemConﬁguring Ports Working with NISWorking with Firewalls Select Kernel Conﬁguration Select Conﬁgurable Parameters Enabling Large Numbers of AgentsEnabling Over 23 Agents Thread Limits To change the value of maxthreadprocTo view and change the value of tcpconnrequestmax Enabling Over 20 Inbound RequestsFiles Permissions Accessing ManpagesRestricting Permissions Runtime File PermissionsAccessing Manpages Chapter Getting Started Getting Started System Manager AgentsStarting HP-UX Hids for the First Time Set up hosts and run schedulesSee , Host Manager Screen, on Network Node Operations ScreensSchedule Manager Host ManagerSorting Entries Basic Screen ActionsSelecting Entries in Lists Searching EntriesBasic Screen Actions Chapter System Manager Screen System Manager Screen System Manager Screen To stop the HP-UX Hids System Manager Starting the HP-UX Hids System ManagerStopping the HP-UX Hids System Manager To start the HP-UX Hids System ManagerOn the System Manager Screen Status Field ValuesStatus Value Description Getting the Status of Agent Hosts To get the status of agent hostsOn the System Manager screen To resynchronize agent hosts Resynchronizing Agent HostsActivating a Schedule on Agent Hosts To activate a surveillance schedule on agent hostsChoose the Actions Activate Schedule menu item To stop a surveillance schedule on agent hosts Stopping Schedules on Agent HostsTo start the agent Starting HP-UX Hids AgentsHalting HP-UX Hids Agents To halt agents remotely from the System ManagerTo halt the agent locally on the agent host To go to the Schedule Manager screen Accessing Other ScreensGo to Schedule Manager Screen Go to Host Manager ScreenGo to Network Node Screen Go to Preferences ScreenReturn to System Manager Screen Accessing Other Screens Chapter Schedule Manager Screen Schedule Manager Screen Schedule Manager To create a surveillance schedule Creating a Surveillance ScheduleTo close the Schedule Manager screen Displaying the Schedule Manager ScreenClosing the Schedule Manager Screen To display the Schedule Manager screenTo create a new surveillance schedule Conﬁguring Surveillance SchedulesCreating a New Surveillance Schedule Copying a Surveillance ScheduleTo modify a surveillance schedule Modifying a Surveillance ScheduleRenaming a Surveillance Schedule To rename a surveillance scheduleChoose File Save Selected Schedule As Deleting a Surveillance Schedule Undoing and Redoing ChangesTo delete a surveillance schedule Saving a Surveillance Schedule To save a surveillance scheduleChoose File Save Selected Schedule To create a new surveillance group Conﬁguring Surveillance GroupsCreating a New Surveillance Group Copying a Surveillance GroupTo modify a surveillance group Modifying a Surveillance GroupRenaming a Surveillance Group Rename Surveillance Group DialogTo rename a surveillance group Deleting a Surveillance Group Saving a Surveillance GroupTo delete a surveillance group Conﬁguring Detection Templates Modifying a Property Value In a TemplateTo change the value of a property in a detection template To add a new value Edit List Dialog11Edit Dialog Edit Suggested Best PracticesSome Template Conﬁguration Guidelines Setting Surveillance Schedule Timetables To specify when a schedule will run Specifying When a Schedule Will RunCanceling Changes See Saving a Surveillance Schedule on To view the source of a surveillance schedule Viewing Surveillance Schedule DetailsViewing the Source of a Surveillance Schedule Refreshing the Details DisplayTo clear the display Clearing the Details DisplaySaving the Details Display Save DialogPredeﬁned Surveillance Schedules Predeﬁned Surveillance Schedules and GroupsPredeﬁned Surveillance Schedules Host Manager Screen Host Manager Screen Displaying the Host Manager Screen Managing HostsClosing the Host Manager Screen To add a new host manually Adding New HostsAdding a New Host Manually Add Host DialogHost Name Address ﬁeldIP Address To add new hosts from /etc/hosts Adding New Hosts from /etc/hostsName ﬁeld Host Name and IP AddressTo add new hosts from a ﬁle Adding New Hosts from a FileRules for Host Lists Files Open DialogTo modify a host entry Modifying a HostTo delete a host entry Deleting HostsEnabling and Disabling Hosts To enable or disable an agent host for monitoringAdd, modify or delete tags To add a tag Managing TagsTo delete a tag To edit a tagMaintaining Host Files Saving the Host List in the Current FileSaving the Host List in a Different File Using Multiple Host Files Using an Alternate Host List FileMaintaining Host Files Chapter Network Node Screen 100 To display the Network Node screen for an agent host Network Node ScreenOpening a Network Node Screen Closing a Network Node Screen102 Alerts TabHP-UX Hids Alerts What They Mean, What to Do Errors Tab HP-UX Hids Errors What They Mean, What to Do104 Simple Version General OperationsSelecting Entries Selecting with the MouseSearching for the Next Unseen Entry Searching for a StringFind Dialog To search again To delete one or more alerts or errorsDeleting an Entry Marking Entries as Seen or Unseen108 UnseenSaving a New Log File Set Saving a Log File SetNetwork Node screen from the System Manager screen Saving the Current Log File SetExample Saving the File Set over Another File Set Save Dialog BoxPress Ctrl-A Example Creating a New File SetOpening a Log File Set Log File RotationOpen Dialog Box 112 Preferences Screen 114 Preferences Screen 116 Option Default DescriptionGeneral Preferences To choosing Actions Status Poll from the System ManagerActions Resync from the System Manager screen 118 Column Name Default DescriptionBrowser Preferences Alert Events PreferencesColumn Default Description Name Error Events Preferences120 System Manager SubtabTemplates and Alerts Templates AlertsLimitations Property TypesAlert Summary Table A-1 Detection TemplatesAttack Detected Alert Alert Severity Detection Template 124 Appendix a 125 Unix Regular Expressions Examples126 Appendix a 127 128 LimitationsType I Pathnames to Not Monitor Template Property Types130 Type II Pathnames/Programs PairsType IV UID Pairs Type III UIDsType V Network Triplets Type VI Time Strings132 Type Viii Scalars Type VII Flags134 Buffer Overﬂow TemplateTable A-3 Execute on Stack Alert Properties Name Type Default ValueExecute on Stack Table A-2 Template Properties136 Table A-4 Unusual Argument Length Alert Properties Unusual Argument Length138 Argument with Non-printable CharacterAppendix a 139 140 Table A-6 Template Properties Race Condition TemplateFile Reference Modiﬁcation Table A-7 File Reference Modiﬁcation Alert Properties142 Appendix a 143 Privileged Setuid Script Executed Table A-8 Setuid Script Executed Alert Properties144 Appendix a 145 Modiﬁcation of Files/Directories Template Table A-9 Template Properties146 Properties 148 Table A-10 File Being Modiﬁed Alert Properties File Being Modiﬁed150 Appendix a 151 Changes to Log File Template Table A-11 Template Properties152 Table A-12 Append-Only File Being Modiﬁed Alert Properties Append-Only File Being Modiﬁed154 By this template Creation of Setuid File TemplateTable A-13 Template Properties Alerts generatedSetuid File Created Table A-14 Setuid File Created Alert Properties156 Appendix a 157 Creation of World-Writable File Template Table A-15 Template Properties158 Table A-16 World-writable File Created Alert Properties World-Writable File Created160 Appendix a 161 162 Table A-17 Template Properties Modiﬁcation of Another User’s File TemplateNon-owned File Being Modiﬁed Table A-18 Non-owned File Being Modiﬁed Alert Properties164 Appendix a 165 Limitations 166 Table A-19 Template Properties Login/Logout Template168 Table A-20 Login/Logout Alert Properties Login/LogoutSuccessful su Detected Table A-21 Successful su Detected Alert Properties170 Appendix a 171 172 Repeated Failed Logins Template Table A-22 Template PropertiesTemplate How this template Failed Login Attempts Table A-23 Failed Login Attempts Alert Properties174 Appendix a 175 Table A-25 Repeated Failed Su Attempts Alert Properties Repeated Failed su Commands TemplateRepeated Failed su Attempts Table A-24 Template PropertiesAppendix a 177 178 Template Conﬁguration SyntaxAppendix a 179 180 Automated Response 182 Response Methods General Guidelines184 Programming Notes How Automated Response Works in HP-UX HidsAlert Process Security checks186 Table B-1 Additional Arguments Passed to Response ProgramsAppendix B 187 Table B-3 Environment Variables Set for Response Programs Name Value Description188 Appendix B 189 190 Programming GuidelinesWriting Perl vs. Shell Response Scripts Writing Privileged Response ProgramsSolution a Code ExamplesCode for scriptA.sh 192 Solution BCode for privA program Code for PrivB programSolution C Code for privC program Code for scriptC.sh script #!/usr/bin/sh194 Sample Response Programs Sample C Language Program Source CodeSample Shell Script Alert Responses 196 Forwarding InformationAppendix B 197 198 Halting any further attacksAppendix B 199 200 Preservation of evidenceAppendix B 201 202 Restoration of a known good stateHP OpenView Operations Smart Plug-In OVO Enablement in HP-UX Hids204 Idsagent Command 206 Synopsis Options Idsagent Command208 ExampleIdsadmin Command 210 Synopsis Startup Options Idsadmin Command212 CommandsAgent Conﬁguration File 214 Forcing Active Agent to Reread Conﬁguration File Agent Conﬁguration File216 Name Default ValueGlobal Conﬁguration Table E-1 Global Conﬁguration VariablesDSP idskernDSP Parameters Data Source Process ConﬁgurationKernel Audit Data DSP Table E-2218 Remote Communication Conﬁguration Table E-3Correlator Conﬁguration Variables 220 Messages 222 Agent Messages Idsagent failed to start group Idsagent failed to reopen stderr in append modeIdsagent internal error in handling signature groups Idsagent failed to initialize conﬁguration moduleIdsagent unable to setup Sigsegv signal handler Idsagent unable to setup Sigchld signal handlerIdsagent unable to setup Sighup signal handler Idsagent unable to setup signal handlerIdsagent failed to execute correlator corr Idsagent error trying to shutdown a processIdsagent failed to allocate memory Idsagent failed to create schedule path ﬁlenameIdsagent failed to initialize schedule in crontab Idsagent internal error no correlator in PMStartProcessesIdsagent internal error occurred in PMStopGroup Idsagent failed to initialize scheduleIdsagent out of process table space Idsagent not enough disk space to create scheduleIdsagent not enough disk space to parse schedule Idsagent not enough disk space to save conﬁg ﬁleInternal error Internal error unknown stateUnable to open the response script directory dir System Manager Messages Invalid Property Value value Property Value Error Exception while opening ﬁle filename File Save ErrorIncomplete or Invalid Entry Data Entry Error Invalid Host State Unable to disable hostSelect Property to be edited Selection Error No more instances of searchstring found Find ErrorOnly one property may be edited at a time Selection Error Searchstring not found Find ErrorSelect Surveillance Schedule to delete Selection Error Select Surveillance Group Name to delete Selection ErrorSelect Surveillance Group to copy Selection Error Select Surveillance Schedule to copy Selection Error234 Surveillance Schedule not selected Schedule Selection ErrorFollowing hosts are in an invalid state for this command Unable to Overwrite filename File Save ErrorUnknown IP Address unable to resolve Host Name Unknown Host unable to resolve IP Address IPaddress236 Troubleshooting 238 Appendix G 239 Troubleshooting Agent and System Manager cannot communicate with each other240 $ /usr/sbin/kmtune -q enableidds Agent does not start on system boot242 Agent needs further troubleshootingTo clean up the IDS message queues Agent host appears to hang and/or you see message disk fullAlerts are not being displayed in the alert browser Agent does not start after installationAgents appear to be stuck in polling status Alert date/time sort seems inconsistent244 Idsadmin needs installed agent certiﬁcatesBuffer overﬂow triggers false positives Duplicate alerts appear in System ManagerIDSgenAdminKeys or idsgui quits early IDScheckInstall fails with a kmtune error246 Large ﬁles in /var/opt/idsLog ﬁles are ﬁlling up No Agent AvailableSchedule Manager timetable screen appears to hang SSH does not perform a clean exit after idsgent is startedSystem Manager appears to hang System Manager does not start after idsgui is started248 Using HP-UX Hids with IPFilter and SecureShell Unknown program and arguments in certain alert messagesIPFilter rules for HP-UX Hids 250 How to allow the SecureShell daemon to forward X11 trafﬁcAppendix G 251 252 Appendix H 253 HP Software License254 OpenSSL LicenseAppendix H 255 Original SSLeay License256 HP Software License Terms 258

Related manuals

Manual 55 pages 31.55 Kb

Manual 20 pages 7.92 Kb