topic Re: IDS/9000 in Operating System - HP-UX

IDS/9000

Wong_3 — Thu, 28 Feb 2002 02:45:01 GMT

Hi all,

I have just read up about the Intrusion Detection System for HP 9000 series. However, according to the documents that I read, it seemed like its meant for 11i only? I am currently running on ver 11. What are the implications of installing this software??

Re: IDS/9000

Michael Tully — Thu, 28 Feb 2002 02:58:28 GMT

Hi,

IDS was originally set up for 11, but I think that it was full of holes. Vers 2 came out specifically for 11i. Have a look at the link in regards to 11. You will have problems trying to get the version for 11i working on 11.

http://www.docs.hp.com/hpux/onlinedocs/J5083-90004/J5083-90004.html

-Michael

Re: IDS/9000

Brian Markus — Thu, 28 Feb 2002 06:43:56 GMT

I have it running under 11.0 It works great. It's a very young product, however it has all the features of the best tools out for security. I've prevented 3 hacks with it so far.

Hope that helps.

Re: IDS/9000

Rainer von Bongartz — Thu, 28 Feb 2002 07:10:07 GMT

The current release for IDS/9000 is 2.0, which still has a few bugs.

There is currently a beta program for release 2.1 which will be release in short i guess.

This will run under 11.0 and 11i so I suggest you wait for release 2.1.

Regards
Rainer

Re: IDS/9000

Kelli Ward — Thu, 28 Feb 2002 23:28:45 GMT

I am looking to implement IDS on some of my systems. Does anyone know if the system is required to be 'trusted' in order to run?
Thanks,
Kel

Re: IDS/9000

Martin Burnett_2 — Wed, 06 Mar 2002 19:08:22 GMT

Hello,

The IDS Release notes specify that IDS/9000 will run on HP-UX 11.0 or 11i (11.11):

For the system where you plan to install the administration software:

1. You must be running HP-UX revision 11.0 or 11i. To check, enter:
uname -r
2. The system must be at least a PA-RISC 1.1 system.
3. You must have 26 MB of free disk space in /opt/ids and space for configuration files in /etc/opt/ids and log files in /var/opt/ids.
4. If you are running HP-UX 11.0, you must have certain operating system patches. Patch installation is part of these installation instructions.
5. If you are running HP-UX 11i, no patches are required.
6. You must have Java SDK or RTE 1.3.1 (version 1.3.1.00) and all the corresponding Java patches. Java installation is part of these installation instructions.
7. You must be superuser to do the installation.

Agent System

On each system where you plan to install the agent software, that is, on each system that you wish to monitor for security breaches or system misuse:
1. You must be running HP-UX release 11.0 or 11i. To check, enter:
uname -r
2. The system must be at least a PA-RISC 1.1 system.
3. You must have 8 MB of free disk space in /opt/ids.
4. You must have at least 10 MB of free space in /var and room for log files.
5. If you are running HP-UX 11.0, you must have certain patches for both the operating system and the kernel audit system. Patch installation is part of these installation instructions.
6. If you are running HP-UX 11i, no patches are required.
7. The cron daemon must be enabled. See cron(1M) for more information.
8. You must be superuser to do the installation.

Valuable links are:
Release Notes
http://docs.hp.com/hpux/onlinedocs/J5083-90006/J5083-90006.html

Administrators Manual
http://docs.hp.com/hpux/onlinedocs/J5083-90007/J5083-90007.html

Martin

Re: IDS/9000

Joanne Keegan — Wed, 06 Mar 2002 19:27:15 GMT

Hi,

I have this running on HP-UX 11.0. It doesn't have to be on a trusted system. I'm looking forward to version 2.1.

Jo