IDS/9000 alerts on /etc/passwd

[Herrick_2]

I am using IDS 9000 A.02.02 on a server running HP-UX 11.00.

I've found that after an user account is removed from the system, alerts like "Details: User 0 renamed/opened/changed a file to "/etc/passwd" executing ..."
would be reported whenever there is another account login to the system.

Is it normal?

Thanks.

[Jan Sladky]

hi,
I shouldn't be normal, check the /etc/passwd if there is everything ok (has the user been really deleted, some rest of another entry etc ..)

Are you using NIS ?

br Jan

[Herrick_2]

Hi Jan,

I've checked /etc/passwd, /etc/group & /tcb/files/auth. The user has really been deleted and we are not using NIS.

Anything else I can check.

Thanks,
Herrick

[Pierre Pasturel]

Herrick -

Please post the commands you are running to produce these alerts along with the alerts themselves so I can see what is going on.

Thanks
Pierre

[Steven E. Protter]

Sure looks like IDS/9000 may have cached some data from the system, probably /etc/passwd

What happens if you start and stop IDS/9000 or restart the system IDS/9000 is running on?

SEP

[Herrick_2]

The problem happens again after I've performed the following commands last night:
/usr/sbin/useradd USERNAME
/usr/lbin/modprpw -k USERNAME
/usr/sbin/userdel -r USERNAME

The following was captured from /var/opt/ids/alert.log
==================================================
SERVER%192.168.1.11%Thu Sep 16 15:05:37 2004%027%01%3%20040916070537%User ID:0 %02:FILESYSTEM %Filesystem change detected %User 0 changed the permissions of "/etc/passwd" executing an unknown program as PID: 4247
SERVER%192.168.1.11%Thu Sep 16 15:05:37 2004%027%01%2%20040916070537%User ID:0 %02:FILESYSTEM %Filesystem change detected %User 0 opened for modification/truncation "/etc/passwd" executing an unknown program as PID: 4247
SERVER%192.168.1.11%Thu Sep 16 15:05:37 2004%027%01%2%20040916070537%User ID:0 %02:FILESYSTEM %Filesystem change detected %User 0 renamed the file "/etc/passwd" executing an unknown program as PID: 4247
==================================================

And the thing that I've done, which seems to to trigger the message, is just a login using ssh (as indicated by the PID:4247)
==================================================
root 659 1 0 Aug 22 ? 0:00 /opt/ssh/sbin/sshd
root 4240 659 0 15:05:34 ? 0:00 sshd: user01 [priv]
user01 4247 4240 0 15:05:37 ? 0:00 sshd: user01@pts/1
user01 4251 4247 0 15:05:37 pts/1 0:00 -ksh
==================================================

Thanks
Herrick

[Sridhar Bhaskarla]

Hi Herrick,

It is perfectly normal if you enabled "Modification of files/directories " template in IDS. So, when the user account is modified, /etc/passwd will get changed thereby resulting a filesystem change.

You can modify the template to ignore files and directories such as /etc/passwd, /etc/group, /var, /tmp etc., so that you won't get these messages.

-Sri

[Herrick_2]

I've also expected alerts about /etc/passwd would be triggered when I "useradd" & "userdel".

However, I don't understand why the ssh login a few hours after the "useradd" & "userdel" actions would also trigger this kind of alert.

Besides, the problem disappears if I restart the IDS/9000.

Thanks
Herrick