topic Re: IDS 900 Shell Script Alert Response in Operating System - HP-UX

IDS 900 Shell Script Alert Response

John Henrikson — Tue, 01 Apr 2003 17:04:52 GMT

Hello,
I recently installed ids/9000 and was trying to use the sample shell script alert response shown in appendix b of the user manual. The instructions say to simply write the code into files in /opt/ids/response on the agent system. I've done that, but wonder how I can test it to see if it will work?
It seems really sparse.. thanks.

Re: IDS 900 Shell Script Alert Response

Chris Wong — Tue, 01 Apr 2003 21:37:45 GMT

You need to trigger an event. This will depend on what you have configured to be monitored on this client. For example, you may be able to use "su" to root unsuccesfully a number of times to spark an event.

- Chris

Re: IDS 900 Shell Script Alert Response

Pierre Pasturel — Mon, 28 Apr 2003 20:47:18 GMT

As Chris mentioned, the easiest way to test your script is to generate an alert, such as failed su or failed login, while running the appropriate schedule.

FYI, for the next release of IDS (V2.2), this appendix has been expanded to include a discussion on writing privileged response programs. Many of the example response scripts in the appendix need to run with privilege and you should NOT make these setuid privileged scripts on an 11.0/11i system, as this will make your system completely vulnerable to a well known RC attack.

Pierre