Manuals
/
HP
/
Computer Equipment
/
Software
HP
Host Intrusion Detection System (HIDS) manual Maintaining Host Files Chapter
Models:
Host Intrusion Detection System (HIDS)
1
110
270
270
Download
270 pages
6.58 Kb
107
108
109
110
111
112
113
114
<
>
Troubleshooting
Install
Warranty
Set up hosts and run schedules
Idsagent Command
Errors Tab
What is
Solution a
OVO Enablement in HP-UX Hids
Login
Page 110
Image 110
Host Manager Screen
Maintaining Host Files
98
Chapter 6
Page 109
Page 111
Page 110
Image 110
Page 109
Page 111
Contents
Manufacturing Part Number J5083-90013 December
HP-UX Host Intrusion Detection System Administrator’s Guide
Edition
Warranty
Government License
Trademarks
Iii
Conventions
Contents
System Manager Screen
Schedule Manager Screen
Vii
Host Manager Screen
Network Node Screen
Viii
Preferences Screen
Templates and Alerts
Automated Response
Idsagent Command
Idsadmin Command
Agent Configuration File
HP Software License
Troubleshooting
Messages
Original SSLeay License HP Software License Terms
Xii
Overview
Summary
Documentation
Loss of Intellectual Property
Why Do You Need Intrusion Detection?
Loss of Financial Assets
Loss of Computing Resources
Misplaced Trust
Who Are the Perpetrators?
How Are These Threats Realized?
Malicious Code
Being Used as a Springboard to Attack the Next Victim
Why Existing Tools Are Only Part of the Solution
Excessive Privilege for Simple Tasks
Firewalls
Encryption
Security Auditing Tools
Where Does Intrusion Detection Fit In?
What Is Intrusion Detection?
What HP-UX Hids Does
What HP-UX Hids Does Not Do
HP-UX Hids Components
Graphic Representation
How the Components Interact to Detect Intrusions
HP-UX Hids Components
Surveillance Groups
HP-UX Hids Secure Communications
Detection Templates
Surveillance Schedules
Glossary of HP-UX Hids Terms
Kernel
Intrusion Detection Data
Intrusion Detection System
Node
Vulnerability
System Manager
Virus
Glossary of HP-UX Hids Terms Chapter
Configuration
Configuration
Optional
Introduction
Required
Script to Use Where Used End Product
Setting Up the HP-UX Hids Secure Communications
Overview of Procedures to Set Up Secure Communications
Create the X.509 Certificates
$ IDSgenAdminKeys install
$ IDSgenAgentCerts
TIP
Transport the Certificates
Install the Keys on Each Host
$ IDSimportAgentKeys /var/opt/ids/tmp/myhost1.tar.Z myadmin
Configuring a Multihomed Agent System
Step
Example
$ nslookup large2
Configuring a Multihomed Administration System
To configure a multihomed administration system
Edit the agent configuration file for example
Configuring a Loopback System
To configure a loopback system
Working with Firewalls
Configuring Ports
Working with NIS
To change the value of maxthreadproc
Enabling Large Numbers of Agents
Enabling Over 23 Agents Thread Limits
Select Kernel Configuration Select Configurable Parameters
Enabling Over 20 Inbound Requests
To view and change the value of tcpconnrequestmax
Runtime File Permissions
Accessing Manpages
Restricting Permissions
Files Permissions
Accessing Manpages Chapter
Getting Started
Getting Started
Agents
System Manager
Set up hosts and run schedules
Starting HP-UX Hids for the First Time
See , Host Manager Screen, on
Host Manager
Operations Screens
Schedule Manager
Network Node
Searching Entries
Basic Screen Actions
Selecting Entries in Lists
Sorting Entries
Basic Screen Actions Chapter
System Manager Screen
System Manager Screen
System Manager Screen
To start the HP-UX Hids System Manager
Starting the HP-UX Hids System Manager
Stopping the HP-UX Hids System Manager
To stop the HP-UX Hids System Manager
Status Value Description
On the System Manager Screen
Status Field Values
On the System Manager screen
Getting the Status of Agent Hosts
To get the status of agent hosts
Resynchronizing Agent Hosts
To resynchronize agent hosts
Choose the Actions Activate Schedule menu item
Activating a Schedule on Agent Hosts
To activate a surveillance schedule on agent hosts
Stopping Schedules on Agent Hosts
To stop a surveillance schedule on agent hosts
Starting HP-UX Hids Agents
To start the agent
To halt the agent locally on the agent host
Halting HP-UX Hids Agents
To halt agents remotely from the System Manager
Go to Host Manager Screen
Accessing Other Screens
Go to Schedule Manager Screen
To go to the Schedule Manager screen
Return to System Manager Screen
Go to Network Node Screen
Go to Preferences Screen
Accessing Other Screens Chapter
Schedule Manager Screen
Schedule Manager Screen
Schedule Manager
Creating a Surveillance Schedule
To create a surveillance schedule
To display the Schedule Manager screen
Displaying the Schedule Manager Screen
Closing the Schedule Manager Screen
To close the Schedule Manager screen
Copying a Surveillance Schedule
Configuring Surveillance Schedules
Creating a New Surveillance Schedule
To create a new surveillance schedule
Modifying a Surveillance Schedule
To modify a surveillance schedule
Choose File Save Selected Schedule As
Renaming a Surveillance Schedule
To rename a surveillance schedule
To delete a surveillance schedule
Deleting a Surveillance Schedule
Undoing and Redoing Changes
Choose File Save Selected Schedule
Saving a Surveillance Schedule
To save a surveillance schedule
Copying a Surveillance Group
Configuring Surveillance Groups
Creating a New Surveillance Group
To create a new surveillance group
Modifying a Surveillance Group
To modify a surveillance group
To rename a surveillance group
Renaming a Surveillance Group
Rename Surveillance Group Dialog
To delete a surveillance group
Deleting a Surveillance Group
Saving a Surveillance Group
To change the value of a property in a detection template
Configuring Detection Templates
Modifying a Property Value In a Template
Edit List Dialog
To add a new value
Suggested Best Practices
11Edit Dialog Edit
Some Template Configuration Guidelines
Setting Surveillance Schedule Timetables
Specifying When a Schedule Will Run
To specify when a schedule will run
Canceling Changes
See Saving a Surveillance Schedule on
Refreshing the Details Display
Viewing Surveillance Schedule Details
Viewing the Source of a Surveillance Schedule
To view the source of a surveillance schedule
Save Dialog
Clearing the Details Display
Saving the Details Display
To clear the display
Predefined Surveillance Schedules and Groups
Predefined Surveillance Schedules
Predefined Surveillance Schedules
Host Manager Screen
Host Manager Screen
Managing Hosts
Displaying the Host Manager Screen
Closing the Host Manager Screen
Add Host Dialog
Adding New Hosts
Adding a New Host Manually
To add a new host manually
IP Address
Host Name
Address field
Host Name and IP Address
Adding New Hosts from /etc/hosts
Name field
To add new hosts from /etc/hosts
Open Dialog
Adding New Hosts from a File
Rules for Host Lists Files
To add new hosts from a file
Modifying a Host
To modify a host entry
Deleting Hosts
To delete a host entry
To enable or disable an agent host for monitoring
Enabling and Disabling Hosts
Managing Tags
Add, modify or delete tags To add a tag
To edit a tag
To delete a tag
Saving the Host List in a Different File
Maintaining Host Files
Saving the Host List in the Current File
Using an Alternate Host List File
Using Multiple Host Files
Maintaining Host Files Chapter
Network Node Screen
100
Closing a Network Node Screen
Network Node Screen
Opening a Network Node Screen
To display the Network Node screen for an agent host
Alerts Tab
102
HP-UX Hids Alerts What They Mean, What to Do
104
Errors Tab
HP-UX Hids Errors What They Mean, What to Do
Selecting with the Mouse
General Operations
Selecting Entries
Simple Version
Find Dialog
Searching for the Next Unseen Entry
Searching for a String
Marking Entries as Seen or Unseen
To delete one or more alerts or errors
Deleting an Entry
To search again
Unseen
108
Saving the Current Log File Set
Saving a Log File Set
Network Node screen from the System Manager screen
Saving a New Log File Set
Example Creating a New File Set
Save Dialog Box
Press Ctrl-A
Example Saving the File Set over Another File Set
Open Dialog Box
Opening a Log File Set
Log File Rotation
112
Preferences Screen
114
Preferences Screen
To choosing Actions Status Poll from the System Manager
Option Default Description
General Preferences
116
Actions Resync from the System Manager screen
Alert Events Preferences
Column Name Default Description
Browser Preferences
118
Error Events Preferences
Column Default Description Name
System Manager Subtab
120
Templates and Alerts
Property Types
Alerts
Limitations
Templates
Attack Detected Alert Alert Severity Detection Template
Alert Summary
Table A-1 Detection Templates
124
Appendix a 125
126
Unix Regular Expressions
Examples
Appendix a 127
Limitations
128
Template Property Types
Type I Pathnames to Not Monitor
Type II Pathnames/Programs Pairs
130
Type III UIDs
Type IV UID Pairs
132
Type V Network Triplets
Type VI Time Strings
Type VII Flags
Type Viii Scalars
Buffer Overflow Template
134
Table A-2 Template Properties
Name Type Default Value
Execute on Stack
Table A-3 Execute on Stack Alert Properties
136
Unusual Argument Length
Table A-4 Unusual Argument Length Alert Properties
Argument with Non-printable Character
138
Appendix a 139
140
Race Condition Template
Table A-6 Template Properties
142
File Reference Modification
Table A-7 File Reference Modification Alert Properties
Appendix a 143
144
Privileged Setuid Script Executed
Table A-8 Setuid Script Executed Alert Properties
Appendix a 145
146
Modification of Files/Directories Template
Table A-9 Template Properties
Properties
148
File Being Modified
Table A-10 File Being Modified Alert Properties
150
Appendix a 151
152
Changes to Log File Template
Table A-11 Template Properties
Append-Only File Being Modified
Table A-12 Append-Only File Being Modified Alert Properties
154
Alerts generated
Creation of Setuid File Template
Table A-13 Template Properties
By this template
156
Setuid File Created
Table A-14 Setuid File Created Alert Properties
Appendix a 157
158
Creation of World-Writable File Template
Table A-15 Template Properties
World-Writable File Created
Table A-16 World-writable File Created Alert Properties
160
Appendix a 161
162
Modification of Another User’s File Template
Table A-17 Template Properties
164
Non-owned File Being Modified
Table A-18 Non-owned File Being Modified Alert Properties
Appendix a 165
Limitations 166
Login/Logout Template
Table A-19 Template Properties
168
Login/Logout
Table A-20 Login/Logout Alert Properties
170
Successful su Detected
Table A-21 Successful su Detected Alert Properties
Appendix a 171
172
Template How this template
Repeated Failed Logins Template
Table A-22 Template Properties
174
Failed Login Attempts
Table A-23 Failed Login Attempts Alert Properties
Appendix a 175
Table A-24 Template Properties
Repeated Failed su Commands Template
Repeated Failed su Attempts
Table A-25 Repeated Failed Su Attempts Alert Properties
Appendix a 177
Template Configuration Syntax
178
Appendix a 179
180
Automated Response
182
General Guidelines
Response Methods
184
Security checks
How Automated Response Works in HP-UX Hids
Alert Process
Programming Notes
Table B-1 Additional Arguments Passed to Response Programs
186
Appendix B 187
188
Table B-3 Environment Variables Set for Response Programs
Name Value Description
Appendix B 189
Writing Privileged Response Programs
Programming Guidelines
Writing Perl vs. Shell Response Scripts
190
Code for scriptA.sh
Solution a
Code Examples
Code for PrivB program
Solution B
Code for privA program
192
Solution C
194
Code for privC program
Code for scriptC.sh script #!/usr/bin/sh
Sample Shell Script Alert Responses
Sample Response Programs
Sample C Language Program Source Code
Forwarding Information
196
Appendix B 197
Halting any further attacks
198
Appendix B 199
Preservation of evidence
200
Appendix B 201
Restoration of a known good state
202
OVO Enablement in HP-UX Hids
HP OpenView Operations Smart Plug-In
204
Idsagent Command
206
Idsagent Command
Synopsis Options
Example
208
Idsadmin Command
210
Idsadmin Command
Synopsis Startup Options
Commands
212
Agent Configuration File
214
Agent Configuration File
Forcing Active Agent to Reread Configuration File
Table E-1 Global Configuration Variables
Name Default Value
Global Configuration
216
Table E-2
Data Source Process Configuration
Kernel Audit Data DSP
DSP idskernDSP Parameters
218
Correlator Configuration Variables
Remote Communication Configuration
Table E-3
220
Messages
222
Agent Messages
Idsagent failed to initialize configuration module
Idsagent failed to reopen stderr in append mode
Idsagent internal error in handling signature groups
Idsagent failed to start group
Idsagent unable to setup signal handler
Idsagent unable to setup Sigchld signal handler
Idsagent unable to setup Sighup signal handler
Idsagent unable to setup Sigsegv signal handler
Idsagent failed to create schedule path filename
Idsagent error trying to shutdown a process
Idsagent failed to allocate memory
Idsagent failed to execute correlator corr
Idsagent failed to initialize schedule
Idsagent internal error no correlator in PMStartProcesses
Idsagent internal error occurred in PMStopGroup
Idsagent failed to initialize schedule in crontab
Idsagent not enough disk space to save config file
Idsagent not enough disk space to create schedule
Idsagent not enough disk space to parse schedule
Idsagent out of process table space
Unable to open the response script directory dir
Internal error
Internal error unknown state
System Manager Messages
Invalid Host State Unable to disable host
Exception while opening file filename File Save Error
Incomplete or Invalid Entry Data Entry Error
Invalid Property Value value Property Value Error
Searchstring not found Find Error
No more instances of searchstring found Find Error
Only one property may be edited at a time Selection Error
Select Property to be edited Selection Error
Select Surveillance Schedule to copy Selection Error
Select Surveillance Group Name to delete Selection Error
Select Surveillance Group to copy Selection Error
Select Surveillance Schedule to delete Selection Error
Unable to Overwrite filename File Save Error
Surveillance Schedule not selected Schedule Selection Error
Following hosts are in an invalid state for this command
234
Unknown Host unable to resolve IP Address IPaddress
Unknown IP Address unable to resolve Host Name
236
Troubleshooting
238
Appendix G 239
240
Troubleshooting
Agent and System Manager cannot communicate with each other
Agent does not start on system boot
$ /usr/sbin/kmtune -q enableidds
Agent host appears to hang and/or you see message disk full
Agent needs further troubleshooting
To clean up the IDS message queues
242
Alert date/time sort seems inconsistent
Agent does not start after installation
Agents appear to be stuck in polling status
Alerts are not being displayed in the alert browser
Duplicate alerts appear in System Manager
Idsadmin needs installed agent certificates
Buffer overflow triggers false positives
244
IDScheckInstall fails with a kmtune error
IDSgenAdminKeys or idsgui quits early
No Agent Available
Large files in /var/opt/ids
Log files are filling up
246
SSH does not perform a clean exit after idsgent is started
Schedule Manager timetable screen appears to hang
248
System Manager appears to hang
System Manager does not start after idsgui is started
IPFilter rules for HP-UX Hids
Using HP-UX Hids with IPFilter and SecureShell
Unknown program and arguments in certain alert messages
How to allow the SecureShell daemon to forward X11 traffic
250
Appendix G 251
252
HP Software License
Appendix H 253
OpenSSL License
254
Original SSLeay License
Appendix H 255
256
HP Software License Terms
258