IDS agent - does not email

[Krishnan Viswanathan]

I have gotten certain shell scripts in the /opt/ids/reponse directory. None of them are executed by the agent! I have restarted the agent,admin console and also the scheduler. But I cant get the email alerts although the alerts are being sent to IDS admin

Any inputs ?

Thanks much
Krishnan

[harry d brown jr]

Krishnan,

Can you execute these scripts manually in the /opt/ids/reponse directory, and do they work as expected? In other words, do the shell scripts work, and are the permissions correct? Remember to check the Owner and Group ID's, because if IDS agent is not root, then it must belong to the group, or be the owner.

live free or die
harry

[Krishnan Viswanathan]

The permission on the script is ids:ids and is executable.
The agent runs as ids.

As regards the script, I am first testing with the sample script given in the IDS9000 manual. All it does is it checks if the alert severity is 1 and then it should email to the list. But I am not sure where or how the script gets the $1,$2,..arguments from(within the IDS)

Thanks
Krishnan

[Rainer von Bongartz]

Krishnan,

here is a small c program that will do the work (mail to root if severity =1)

compile it with cc ids_alertResponse.c -o ids_alertRespnse.o

and copy it to /opt/ids/resonse
and give it the followinf permissions:

-r-x------ 1 ids ids 16384 Feb 22 21:20 ids_alertResponse

Regards
Rainer

[Krishnan Viswanathan]

I have another question :

I have some users who login using their client interface etc. These logins are never reported in IDS ( These users dont have shell access though). Does IDS capture these login data ?
There is a regular entry in the passwd files for these users except that they have shell access turned as false.

Also I was "ssh"inf into my server and IDS never reported my login. Whys is this so ?

On the regular OS level, are these logins captured ? (/etc/btmp file ?)

Thanks
Krishnan

[Steven Sim Kok Leong]

Hi,

For SSH (at least for SSH Communications SSH2), it reports to syslog. Thus you should see both unsuccessful and successful SSH logins in /var/syslog/syslog.log.

Hope this helps. Regards.

Steven Sim Kok Leong

[Steven Sim Kok Leong]

Hi,

For SSH (at least for SSH Communications SSH2), it reports to syslog. Thus you should see both unsuccessful and successful SSH logins in /var/adm/syslog/syslog.log.

Hope this helps. Regards.

Steven Sim Kok Leong

[Steve Bonds · Accepted solution]

SSH does not use the login() function unless specifically configured to do so. This means that many security features called from login() are either bypassed or prevent login.

Enabling login() breaks X11 forwarding, which is why it is not the default. login() will never be used if the user specifies a command to run, so don't rely on this setting for security. See the sshd(8) man page for more information.

SSH is usually configured to use the AUTH facility in syslog which can be sent to a file with more restrictive permissions than the normal system log. (Since on high logging levels the ssh logs can contain sensitive login data.)

The HP-UX default is to send AUTH to the same log as everything else.