HP Host Intrusion Detection System (HIDS) Unknown program and arguments in certain alert messages

Troubleshooting

Troubleshooting

•If the idsagent has died, then restart it. See “Starting HP-UX HIDS Agents” on page 52

•If the System Manager seems to be expecting responses back too quickly, then increasing the Agent Response Timeout value may help alleviate the problem. See “General Preferences” on page 116.

UNKNOWN program and arguments in certain alert messages

Sometimes, alerts occur specifying an UNKNOWN program and arguments. For example:

uid=-1, gid=-1, pid=-1, ppid=-1 file=/dev/dlpi, type=4, mode=8630, uid=0, g id=3, inode=128, device=1073741827 Non-owned file being modified User with uid 0 opened for modificati on/truncation /dev/dlpi (type=4,inode=128,devic e=1073741827) (owned by user with uid 0) when executing UNKNOWN, invoked wi th UNKNOWN arguments, as process with p id 22125 and ppid 22124 and running with effective uid=101 and with effective gid=10

See p.129 “Limitations” for details.

Using HP-UX HIDS with IPFilter and SecureShell

The HP-UX implementation of the IPFilter firewall system can be configured to allow communication among the HP-UX HIDS administration and agent systems. IPFilter is a stateful system that maintains the state of communications across multiple packets or that monitors (proxies) an entire TCP/UDP session.

This section contains a sample set of the IPFilter rules that are needed to enable communication among the HP-UX HIDS components. The IPFilter configuration for HP-UX HIDS can be helpful for configuring another vendor’s firewall to allow proper communication among the HP-UX HIDS components.

IPFilter rules for HP-UX HIDS

This is a sample set of IPFilter rules needed to enable HP-UX HIDS. If you use a firewall other than IPFilter, the explanation presented here should give you enough pointers to set up your own firewall rules.

1.HP-UX HIDS agent listens on port hpidsagent (2985) for incoming connections initiated by HP-UX HIDS System Manager on a remote host.

So if the host running IPFilter is also running an HP-UX HIDS agent, then allow incoming connections initiated by HP-UX HIDS System Manager.

pass in quick proto tcp from any to any port = hpidsagent keep state

2.HP-UX HIDS System Manager listens on port hpidsadmin (2984) for incoming connections initiated by HP-UX HIDS agents.

If the host running IPFilter is also running an HP-UX HIDS System Manager, then allow incoming connections initiated by HP-UX HIDS agents.

pass in quick proto tcp from any to any port = hpidsadmin keep state

3.HP-UX HIDS System Manager uses ephemeral ports to send requests to agent host’s port hpidsagent. Also, HP-UX HIDS agents use ephemeral ports to send responses to the System Manager host’s port hpidsadmin.

Appendix G 249