IDS in HP-UX

[Veron_Le]

Hi all,

It's very urgent to know if IDS in HP-UX can do IPS function

Appreciate all your help
Thanks
Veron

[Steven E. Protter · Accepted solution]

Tell me what IPS stands for and I'll try and answer.

General Doc on IDS:

What IDS Does:
http://www6.itrc.hp.com/service/james/dispDoc.do?docURL=http%3A%2F%2Fdocs.hp.com%2Fen%2FJ5083-90011%2Fch01s03.html&aid=SEARCH_MANUAL&pil=4&serStr=HIDS

What IDS Does not do:
http://www6.itrc.hp.com/service/james/dispDoc.do?docURL=http%3A%2F%2Fdocs.hp.com%2Fen%2FJ5083-90011%2Fch01s04.html&aid=SEARCH_MANUAL&pil=3&serStr=HIDS

SEP

[Veron_Le]

Hi,

IPS is stand for Intrusion Prevention System.

Thanks
Veron

[Jeff Lightner_1]

It appears IPS is Intrusion Prevention System and IDS is Intrusion Detection System. I suspect the distinction is merely marketing. HP has free HIDS (Host Intrustion Detection System) at:
http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUX-HIDS

[Bill Hassell]

There is no specific package (except Bastille) that will perform Intrusion Prevention. Instead, in HP-UX this is done with standard security lockdowns. For instance, to prevent intrusion from telnet, stop the telnetd service in inetd.conf. And to prevent intrusion via standard password guessing techniques, turn on Trusted System. Bastille puts all the intrusion prevention measures into a single step-by-step checklist.

[Veron_Le]

Hi,

Does Bastilla help to monitor and prevent intruder on entire system? If yes, could it report system status to CiscoWork?

Thanks
Veron

[Bill Hassell]

Bastille is a prevention system, that is, it walks you through the different settings needed to disable unnecessary features and increase authentication levels. You would run Bastille during your initial setup of the system, then use IDS to watch your system. IDS has many reporting options, but be aware that setting up IDS and running Bastille does require some basic understandings of HP-UX, networking and your application requirements.