HP Host Intrusion Detection System (HIDS) manual Code for privC program, 194

Automated Response

Programming Guidelines

	A directory with mode 500 and owned by ids:ids.
	/opt/ids/response/misc/scriptC.sh
	A non-setuid script with mode 500 and owned by ids:ids
	You must make sure you do not create a privC program to allow the execution of any
NOTE
	executable with euid root! The path names of the scripts must be hardcoded in privC.c.
	Code for privC program
	#include <stdio.h>
	#include <stdlib.h>
	#include <limits.h>
	int main(int argc, char **argv, char **envp)
	{

char *ids_base;

char script[PATH_MAX+1];

if ((ids_base = getenv(“IDS_BASE”)) == NULL) exit(1);; if (snprintf(script,(size_t)(PATH_MAX+1), “%s/response/misc/scriptC.sh”,ids_base) < 0) exit(1); execve(script,argv,envp);

}

Code for scriptC.sh script #!/usr/bin/sh

## Sample HP-UX HIDS alert response script

## Stop a process which has performed an intrusive activity. RESPONSE_BASE=$IDS_BASE/response

RECIPIENT=”root”

#Setting the umask to a “sane” value umask 077

#If we have a file modification alert if [ $1 = “2” ]

then

#and if the target of the attack is the password file if [ ${17} = “/etc/passwd” ]; then

#obtain the process id from the alert

pid=${11}

echo “Critical intrusion: halting process ${pid} running ${24} that m odified /etc/passwd” \

/usr/bin/mailx -s “$7” ${RECIPIENT} kill -KILL ${pid}

fi

fi

#Exit with no error exit 0

194 Appendix B