Manuals
/
HP
/
Computer Equipment
/
Software
HP
Host Intrusion Detection System (HIDS) manual Preferences Screen
Models:
Host Intrusion Detection System (HIDS)
1
125
270
270
Download
270 pages
6.58 Kb
122
123
124
125
126
127
128
129
<
>
Troubleshooting
Install
Warranty
Set up hosts and run schedules
Idsagent Command
Errors Tab
What is
Solution a
OVO Enablement in HP-UX Hids
Login
Page 125
Image 125
8
Preferences Screen
Chapter 8
113
Page 124
Page 126
Page 125
Image 125
Page 124
Page 126
Contents
Manufacturing Part Number J5083-90013 December
HP-UX Host Intrusion Detection System Administrator’s Guide
Edition
Government License
Warranty
Iii
Trademarks
Conventions
Contents
Schedule Manager Screen
System Manager Screen
Vii
Host Manager Screen
Network Node Screen
Viii
Preferences Screen
Templates and Alerts
Idsadmin Command
Idsagent Command
Automated Response
Agent Configuration File
HP Software License
Troubleshooting
Messages
Original SSLeay License HP Software License Terms
Xii
Overview
Documentation
Summary
Loss of Financial Assets
Why Do You Need Intrusion Detection?
Loss of Intellectual Property
Loss of Computing Resources
How Are These Threats Realized?
Who Are the Perpetrators?
Misplaced Trust
Malicious Code
Excessive Privilege for Simple Tasks
Why Existing Tools Are Only Part of the Solution
Being Used as a Springboard to Attack the Next Victim
Firewalls
Security Auditing Tools
Encryption
What Is Intrusion Detection?
Where Does Intrusion Detection Fit In?
What HP-UX Hids Does
What HP-UX Hids Does Not Do
Graphic Representation
HP-UX Hids Components
HP-UX Hids Components
How the Components Interact to Detect Intrusions
Detection Templates
HP-UX Hids Secure Communications
Surveillance Groups
Surveillance Schedules
Glossary of HP-UX Hids Terms
Intrusion Detection System
Intrusion Detection Data
Kernel
Node
Vulnerability
System Manager
Virus
Glossary of HP-UX Hids Terms Chapter
Configuration
Configuration
Optional
Introduction
Required
Overview of Procedures to Set Up Secure Communications
Setting Up the HP-UX Hids Secure Communications
Script to Use Where Used End Product
Create the X.509 Certificates
$ IDSgenAdminKeys install
$ IDSgenAgentCerts
Transport the Certificates
TIP
$ IDSimportAgentKeys /var/opt/ids/tmp/myhost1.tar.Z myadmin
Install the Keys on Each Host
Step
Configuring a Multihomed Agent System
$ nslookup large2
Example
To configure a multihomed administration system
Configuring a Multihomed Administration System
Edit the agent configuration file for example
To configure a loopback system
Configuring a Loopback System
Working with Firewalls
Configuring Ports
Working with NIS
Enabling Over 23 Agents Thread Limits
Enabling Large Numbers of Agents
To change the value of maxthreadproc
Select Kernel Configuration Select Configurable Parameters
To view and change the value of tcpconnrequestmax
Enabling Over 20 Inbound Requests
Restricting Permissions
Accessing Manpages
Runtime File Permissions
Files Permissions
Accessing Manpages Chapter
Getting Started
Getting Started
System Manager
Agents
Starting HP-UX Hids for the First Time
Set up hosts and run schedules
See , Host Manager Screen, on
Schedule Manager
Operations Screens
Host Manager
Network Node
Selecting Entries in Lists
Basic Screen Actions
Searching Entries
Sorting Entries
Basic Screen Actions Chapter
System Manager Screen
System Manager Screen
System Manager Screen
Stopping the HP-UX Hids System Manager
Starting the HP-UX Hids System Manager
To start the HP-UX Hids System Manager
To stop the HP-UX Hids System Manager
Status Value Description
On the System Manager Screen
Status Field Values
On the System Manager screen
Getting the Status of Agent Hosts
To get the status of agent hosts
To resynchronize agent hosts
Resynchronizing Agent Hosts
Choose the Actions Activate Schedule menu item
Activating a Schedule on Agent Hosts
To activate a surveillance schedule on agent hosts
To stop a surveillance schedule on agent hosts
Stopping Schedules on Agent Hosts
To start the agent
Starting HP-UX Hids Agents
To halt the agent locally on the agent host
Halting HP-UX Hids Agents
To halt agents remotely from the System Manager
Go to Schedule Manager Screen
Accessing Other Screens
Go to Host Manager Screen
To go to the Schedule Manager screen
Return to System Manager Screen
Go to Network Node Screen
Go to Preferences Screen
Accessing Other Screens Chapter
Schedule Manager Screen
Schedule Manager Screen
Schedule Manager
To create a surveillance schedule
Creating a Surveillance Schedule
Closing the Schedule Manager Screen
Displaying the Schedule Manager Screen
To display the Schedule Manager screen
To close the Schedule Manager screen
Creating a New Surveillance Schedule
Configuring Surveillance Schedules
Copying a Surveillance Schedule
To create a new surveillance schedule
To modify a surveillance schedule
Modifying a Surveillance Schedule
Choose File Save Selected Schedule As
Renaming a Surveillance Schedule
To rename a surveillance schedule
To delete a surveillance schedule
Deleting a Surveillance Schedule
Undoing and Redoing Changes
Choose File Save Selected Schedule
Saving a Surveillance Schedule
To save a surveillance schedule
Creating a New Surveillance Group
Configuring Surveillance Groups
Copying a Surveillance Group
To create a new surveillance group
To modify a surveillance group
Modifying a Surveillance Group
To rename a surveillance group
Renaming a Surveillance Group
Rename Surveillance Group Dialog
To delete a surveillance group
Deleting a Surveillance Group
Saving a Surveillance Group
To change the value of a property in a detection template
Configuring Detection Templates
Modifying a Property Value In a Template
To add a new value
Edit List Dialog
11Edit Dialog Edit
Suggested Best Practices
Some Template Configuration Guidelines
Setting Surveillance Schedule Timetables
To specify when a schedule will run
Specifying When a Schedule Will Run
Canceling Changes
See Saving a Surveillance Schedule on
Viewing the Source of a Surveillance Schedule
Viewing Surveillance Schedule Details
Refreshing the Details Display
To view the source of a surveillance schedule
Saving the Details Display
Clearing the Details Display
Save Dialog
To clear the display
Predefined Surveillance Schedules
Predefined Surveillance Schedules and Groups
Predefined Surveillance Schedules
Host Manager Screen
Host Manager Screen
Displaying the Host Manager Screen
Managing Hosts
Closing the Host Manager Screen
Adding a New Host Manually
Adding New Hosts
Add Host Dialog
To add a new host manually
IP Address
Host Name
Address field
Name field
Adding New Hosts from /etc/hosts
Host Name and IP Address
To add new hosts from /etc/hosts
Rules for Host Lists Files
Adding New Hosts from a File
Open Dialog
To add new hosts from a file
To modify a host entry
Modifying a Host
To delete a host entry
Deleting Hosts
Enabling and Disabling Hosts
To enable or disable an agent host for monitoring
Add, modify or delete tags To add a tag
Managing Tags
To delete a tag
To edit a tag
Saving the Host List in a Different File
Maintaining Host Files
Saving the Host List in the Current File
Using Multiple Host Files
Using an Alternate Host List File
Maintaining Host Files Chapter
Network Node Screen
100
Opening a Network Node Screen
Network Node Screen
Closing a Network Node Screen
To display the Network Node screen for an agent host
102
Alerts Tab
HP-UX Hids Alerts What They Mean, What to Do
104
Errors Tab
HP-UX Hids Errors What They Mean, What to Do
Selecting Entries
General Operations
Selecting with the Mouse
Simple Version
Find Dialog
Searching for the Next Unseen Entry
Searching for a String
Deleting an Entry
To delete one or more alerts or errors
Marking Entries as Seen or Unseen
To search again
108
Unseen
Network Node screen from the System Manager screen
Saving a Log File Set
Saving the Current Log File Set
Saving a New Log File Set
Press Ctrl-A
Save Dialog Box
Example Creating a New File Set
Example Saving the File Set over Another File Set
Open Dialog Box
Opening a Log File Set
Log File Rotation
112
Preferences Screen
114
Preferences Screen
General Preferences
Option Default Description
To choosing Actions Status Poll from the System Manager
116
Actions Resync from the System Manager screen
Browser Preferences
Column Name Default Description
Alert Events Preferences
118
Column Default Description Name
Error Events Preferences
120
System Manager Subtab
Templates and Alerts
Limitations
Alerts
Property Types
Templates
Attack Detected Alert Alert Severity Detection Template
Alert Summary
Table A-1 Detection Templates
124
Appendix a 125
126
Unix Regular Expressions
Examples
Appendix a 127
128
Limitations
Type I Pathnames to Not Monitor
Template Property Types
130
Type II Pathnames/Programs Pairs
Type IV UID Pairs
Type III UIDs
132
Type V Network Triplets
Type VI Time Strings
Type Viii Scalars
Type VII Flags
134
Buffer Overflow Template
Execute on Stack
Name Type Default Value
Table A-2 Template Properties
Table A-3 Execute on Stack Alert Properties
136
Table A-4 Unusual Argument Length Alert Properties
Unusual Argument Length
138
Argument with Non-printable Character
Appendix a 139
140
Table A-6 Template Properties
Race Condition Template
142
File Reference Modification
Table A-7 File Reference Modification Alert Properties
Appendix a 143
144
Privileged Setuid Script Executed
Table A-8 Setuid Script Executed Alert Properties
Appendix a 145
146
Modification of Files/Directories Template
Table A-9 Template Properties
Properties
148
Table A-10 File Being Modified Alert Properties
File Being Modified
150
Appendix a 151
152
Changes to Log File Template
Table A-11 Template Properties
Table A-12 Append-Only File Being Modified Alert Properties
Append-Only File Being Modified
154
Table A-13 Template Properties
Creation of Setuid File Template
Alerts generated
By this template
156
Setuid File Created
Table A-14 Setuid File Created Alert Properties
Appendix a 157
158
Creation of World-Writable File Template
Table A-15 Template Properties
Table A-16 World-writable File Created Alert Properties
World-Writable File Created
160
Appendix a 161
162
Table A-17 Template Properties
Modification of Another User’s File Template
164
Non-owned File Being Modified
Table A-18 Non-owned File Being Modified Alert Properties
Appendix a 165
Limitations 166
Table A-19 Template Properties
Login/Logout Template
168
Table A-20 Login/Logout Alert Properties
Login/Logout
170
Successful su Detected
Table A-21 Successful su Detected Alert Properties
Appendix a 171
172
Template How this template
Repeated Failed Logins Template
Table A-22 Template Properties
174
Failed Login Attempts
Table A-23 Failed Login Attempts Alert Properties
Appendix a 175
Repeated Failed su Attempts
Repeated Failed su Commands Template
Table A-24 Template Properties
Table A-25 Repeated Failed Su Attempts Alert Properties
Appendix a 177
178
Template Configuration Syntax
Appendix a 179
180
Automated Response
182
Response Methods
General Guidelines
184
Alert Process
How Automated Response Works in HP-UX Hids
Security checks
Programming Notes
186
Table B-1 Additional Arguments Passed to Response Programs
Appendix B 187
188
Table B-3 Environment Variables Set for Response Programs
Name Value Description
Appendix B 189
Writing Perl vs. Shell Response Scripts
Programming Guidelines
Writing Privileged Response Programs
190
Code for scriptA.sh
Solution a
Code Examples
Code for privA program
Solution B
Code for PrivB program
192
Solution C
194
Code for privC program
Code for scriptC.sh script #!/usr/bin/sh
Sample Shell Script Alert Responses
Sample Response Programs
Sample C Language Program Source Code
196
Forwarding Information
Appendix B 197
198
Halting any further attacks
Appendix B 199
200
Preservation of evidence
Appendix B 201
202
Restoration of a known good state
HP OpenView Operations Smart Plug-In
OVO Enablement in HP-UX Hids
204
Idsagent Command
206
Synopsis Options
Idsagent Command
208
Example
Idsadmin Command
210
Synopsis Startup Options
Idsadmin Command
212
Commands
Agent Configuration File
214
Forcing Active Agent to Reread Configuration File
Agent Configuration File
Global Configuration
Name Default Value
Table E-1 Global Configuration Variables
216
Kernel Audit Data DSP
Data Source Process Configuration
Table E-2
DSP idskernDSP Parameters
218
Correlator Configuration Variables
Remote Communication Configuration
Table E-3
220
Messages
222
Agent Messages
Idsagent internal error in handling signature groups
Idsagent failed to reopen stderr in append mode
Idsagent failed to initialize configuration module
Idsagent failed to start group
Idsagent unable to setup Sighup signal handler
Idsagent unable to setup Sigchld signal handler
Idsagent unable to setup signal handler
Idsagent unable to setup Sigsegv signal handler
Idsagent failed to allocate memory
Idsagent error trying to shutdown a process
Idsagent failed to create schedule path filename
Idsagent failed to execute correlator corr
Idsagent internal error occurred in PMStopGroup
Idsagent internal error no correlator in PMStartProcesses
Idsagent failed to initialize schedule
Idsagent failed to initialize schedule in crontab
Idsagent not enough disk space to parse schedule
Idsagent not enough disk space to create schedule
Idsagent not enough disk space to save config file
Idsagent out of process table space
Unable to open the response script directory dir
Internal error
Internal error unknown state
System Manager Messages
Incomplete or Invalid Entry Data Entry Error
Exception while opening file filename File Save Error
Invalid Host State Unable to disable host
Invalid Property Value value Property Value Error
Only one property may be edited at a time Selection Error
No more instances of searchstring found Find Error
Searchstring not found Find Error
Select Property to be edited Selection Error
Select Surveillance Group to copy Selection Error
Select Surveillance Group Name to delete Selection Error
Select Surveillance Schedule to copy Selection Error
Select Surveillance Schedule to delete Selection Error
Following hosts are in an invalid state for this command
Surveillance Schedule not selected Schedule Selection Error
Unable to Overwrite filename File Save Error
234
Unknown IP Address unable to resolve Host Name
Unknown Host unable to resolve IP Address IPaddress
236
Troubleshooting
238
Appendix G 239
240
Troubleshooting
Agent and System Manager cannot communicate with each other
$ /usr/sbin/kmtune -q enableidds
Agent does not start on system boot
To clean up the IDS message queues
Agent needs further troubleshooting
Agent host appears to hang and/or you see message disk full
242
Agents appear to be stuck in polling status
Agent does not start after installation
Alert date/time sort seems inconsistent
Alerts are not being displayed in the alert browser
Buffer overflow triggers false positives
Idsadmin needs installed agent certificates
Duplicate alerts appear in System Manager
244
IDSgenAdminKeys or idsgui quits early
IDScheckInstall fails with a kmtune error
Log files are filling up
Large files in /var/opt/ids
No Agent Available
246
Schedule Manager timetable screen appears to hang
SSH does not perform a clean exit after idsgent is started
248
System Manager appears to hang
System Manager does not start after idsgui is started
IPFilter rules for HP-UX Hids
Using HP-UX Hids with IPFilter and SecureShell
Unknown program and arguments in certain alert messages
250
How to allow the SecureShell daemon to forward X11 traffic
Appendix G 251
252
Appendix H 253
HP Software License
254
OpenSSL License
Appendix H 255
Original SSLeay License
256
HP Software License Terms
258
