topic Re: IDS and kill command in Operating System - HP-UX

IDS and kill command

David_711 — Wed, 27 Oct 2004 17:07:23 GMT

Hi,
Is it possible monitoring the execution of the command kill with ids??

Thanks
David

Re: IDS and kill command

Steven E. Protter — Wed, 27 Oct 2004 18:11:51 GMT

You can kill any running process.

Identify the process id from ps -ef grep ids
and kill the process id.

kill

Regards,

SEP

Re: IDS and kill command

David_711 — Thu, 28 Oct 2004 10:01:53 GMT

Thanks, but i donÂ´t want kill the ids daemon i want monitoring the kill command with my HIDS9000 aplication in my HPUX 11.11 server.

Thanks
Dav

Re: IDS and kill command

RAC_1 — Thu, 28 Oct 2004 10:26:56 GMT

If you convert your system to trusted mode, it is possible. What you need to do is, convert the system to trusted mode and enable auditing. with auditing monitor usage of kill sys call.

The detailed procedure for setting up accounting can be searched in forums. Converting system to trsuetd mode is doing /etc/tsconvert -c;/usr/lbin/modprpw -V

If you can not convert to trsuetd mode, we can do some script work to log all instances of kill command.

what you do is mv original kill command to some other dir/location. Instead of kill command have a script like follows.

#!/usr/bin/ksh

command = $(echo $0)
args = $(echo $*)

echo "${date} $(echo ${logname}) ${command} " >> /tmp/kill.log

/path/to/original/kill ${args}

The script has not been tested and may need some tuning.

Anil