Security Alerts

For servers that have the LIDS host intrusion detection service enabled, and someone tries to disable it, but gives an incorrect password three times in a row in under a one minute interval, an e-mail will be sent to the administrator whose address was specified in the Change Administrator E-Mail Address section.

• [NOTE:]Chances are you can safely ignore this section. If you are uncertain of what to do should this event arise, contact Guardian Digital for further assistance and we will be glad to help.

The e-mail will contain instructions on how to handle the situation. It will look similar to the example below:

A password to disable the host intrusion monitor was entered three (3) times incorrectly. This could be an error of the system administrator or it could be someone attempting to gain unauthorized access.  
 

We suggest checking in to this matter as soon as possible. To check if the host intrusion monitor is properly running login to your Lockbox as the root user. Instructions on this can be found in Section 6 of the documentation, and type: 
 

lidsadm -r  
 

This will return the current running status of the intrusion monitor. If the monitor is not running you should turn it back on. Do this by typing: 
 

lidsadm -S - +LIDS_GLOBAL 
 

It will prompt you for your host intrusion monitor password. Once the password is correctly entered the intrusion monitor will be enabled. You can scan the logs through the GD WebTool for more detailed information. You can also read more on the intrusion monitor in Section 9 of your of your manual.

This error will only occur under the following conditions:

• A wrong password is entered in three times in a row to disable LIDS
• A wrong password is entered in three times in a row to enable LIDS
• A wrong password is entered in three times in a row to reload the LIDS configuration

What this means is that either a user with root access accidently entered in the password wrong three times in a row or an unauthorized user has attempted to gain access.

If you only use the GD WebTool to administer your EnGarde system you should rarely see this message.

In the event of this e-mail, you are welcome to contact Guardian Digital for further assistance. Read Section Introduction - Obtaining Technical Supporton how to contact Guardian Digital.