HP Host Intrusion Detection System (HIDS) manual Appendix B 199

IMPORTANT

NOTE

Automated Response

Sample Response Programs

Disable remote networking If you have determined that an intrusion is originating from a remote location, this script will disable networking on the system.

This script requires privilege and should not be installed as a setuid privileged script. This script is for illustration purposes only. Please refer to “Writing Privileged Response Programs” on page 190 for help on how to safely write a privileged response program.

The agent will be unable to make new connections to the HP-UX HIDS System Manager and you will have to log in to the system at the console. Any existing connections will remain open, but new connections handled by inetd will be refused.

#!/usr/bin/sh

## Sample HP-UX HIDS alert response script

#Disable networking on the system as an extreme response to

#a remote launched intrusion.

RECIPIENT="root"

#If we have a file modification alert if [ $1 = "2" ]

then

#and if the target of the attack is the password file if [ ${17} = "/etc/passwd" ]; then

echo "Critical intrusion: halting networking\n$8" \ /usr/bin/mailx -s "$7" ${RECIPIENT}

/sbin/init.d/inetd stop fi

fi

Appendix B 199