IDS 900 Shell Script Alert Response

[John Henrikson]

Hello,
I recently installed ids/9000 and was trying to use the sample shell script alert response shown in appendix b of the user manual. The instructions say to simply write the code into files in /opt/ids/response on the agent system. I've done that, but wonder how I can test it to see if it will work?
It seems really sparse.. thanks.

[Chris Wong · Accepted solution]

You need to trigger an event. This will depend on what you have configured to be monitored on this client. For example, you may be able to use "su" to root unsuccesfully a number of times to spark an event.

- Chris

[Pierre Pasturel]

As Chris mentioned, the easiest way to test your script is to generate an alert, such as failed su or failed login, while running the appropriate schedule.

FYI, for the next release of IDS (V2.2), this appendix has been expanded to include a discussion on writing privileged response programs. Many of the example response scripts in the appendix need to run with privilege and you should NOT make these setuid privileged scripts on an 11.0/11i system, as this will make your system completely vulnerable to a well known RC attack.

Pierre