IDS and kill command

[David_711]

Hi,
Is it possible monitoring the execution of the command kill with ids??

Thanks
David

[Steven E. Protter]

You can kill any running process.

Identify the process id from ps -ef grep ids
and kill the process id.

kill

Regards,

SEP

[David_711]

Thanks, but i don´t want kill the ids daemon i want monitoring the kill command with my HIDS9000 aplication in my HPUX 11.11 server.

Thanks
Dav

[RAC_1]

If you convert your system to trusted mode, it is possible. What you need to do is, convert the system to trusted mode and enable auditing. with auditing monitor usage of kill sys call.

The detailed procedure for setting up accounting can be searched in forums. Converting system to trsuetd mode is doing /etc/tsconvert -c;/usr/lbin/modprpw -V

If you can not convert to trsuetd mode, we can do some script work to log all instances of kill command.

what you do is mv original kill command to some other dir/location. Instead of kill command have a script like follows.

#!/usr/bin/ksh

command = $(echo $0)
args = $(echo $*)

echo "${date} $(echo ${logname}) ${command} " >> /tmp/kill.log

/path/to/original/kill ${args}

The script has not been tested and may need some tuning.

Anil