topic Alert 29 in IDS-9000 on file /dev/diag/diag2 in Operating System - HP-UX

Alert 29 in IDS-9000 on file /dev/diag/diag2

Richard Falt — Thu, 05 Jul 2001 17:55:11 GMT

I have just recently installed IDS-9000 on my L1 9000 server running HP-UX 11.00.

I get an enormous amount of alerts (code 29) for a file /dev/diag/diag2.

Is is safe to exclude this file in the template?

Sincerely,

Richard Falt

Re: Alert 29 in IDS-9000 on file /dev/diag/diag2

Theresa Patrie — Mon, 06 Jan 2003 12:47:38 GMT

Richard,
I am now seeing the same thing having just installed IDS. What did you find out about this?
Thanks,
Theresa

Re: Alert 29 in IDS-9000 on file /dev/diag/diag2

Richard Falt — Mon, 06 Jan 2003 13:24:13 GMT

Theresa,
I never received a "good" answer but I went ahead and excluded this file.

Richard

Re: Alert 29 in IDS-9000 on file /dev/diag/diag2

Steve Steel — Mon, 06 Jan 2003 13:32:18 GMT

Hi

See
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x4d817d4cf554d611abdb0090277a778c,00.html

It points you to the good documentation.

The following list maps the Code values to the name of the detection
template that generates them.
Code Detection Template
5 Buffer overflow attacks
6 Race condition attacks
9 Creation of SetUID files
13 Creation of world-writable files
15 Repeated failed su commands
16 Repeated failed logins
27 Modification of files/directories
28 Changes to log files
29 Modification of another user???s files
30 Monitor start of interactive sessions
31 Monitor logins/logouts

As you can see an alert 29 comes when this file is accessed by a not owner so excluding is best

Steve Steel

Re: Alert 29 in IDS-9000 on file /dev/diag/diag2

Pierre Pasturel_1 — Thu, 09 Jan 2003 21:34:32 GMT

Does your alert detail for these alerts specify which program modified a non-owned file?

Can you post the entire alert detail for one of these alerts?

Pierre

Re: Alert 29 in IDS-9000 on file /dev/diag/diag2

Pierre Pasturel_1 — Wed, 15 Jan 2003 20:14:58 GMT

I believe you are seeing alerts for memlogd (running as root) opening for read/write /dev/diag/diag2 (owned by bin). Although memlogd is not actually modifying the file (it is making an ioctl call to get info about the system), we do flag *potential* modification by non-owner users, which include opening files with write permission.

Instead of excluding /dev/diag/diag2 by putting it in the "Ignore changes to these files" property of the "Modificaton of another user's files" template, it would be better to add /dev/diag/diag2 to one of the "Files modified by Program X" template and add the full pathname of memlogd in the corresponding "Program List X," where X can equal 1, 2, or 3.

We will be updating the default template property values to reduce some of these alerts in our upcoming V2.2 available in late Spring/early Summer.

Pierre