mirror of
https://github.com/Zeckmathederg/glfs.git
synced 2025-02-01 21:12:12 +08:00
064db32a39
git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@876 af4574ff-66df-0310-9fd7-8a98e5e911e0
81 lines
3.7 KiB
XML
81 lines
3.7 KiB
XML
<sect2>
|
|
<title>Configuring tripwire</title>
|
|
|
|
<sect3><title>Config files</title>
|
|
<para><userinput>/etc/tripwire</userinput></para>
|
|
</sect3>
|
|
|
|
<sect3><title>Configuration Information</title>
|
|
|
|
<para>Tripwire uses a policy file to determine which files integrity
|
|
are checked. The default policy file (<filename>twpol.txt</filename> found in
|
|
<filename>/etc/tripwire/</filename>) is for a default installation of Redhat
|
|
7.0 and is woefully outdated.</para>
|
|
|
|
<para>Policy files are also a custom thing and should be tailored to
|
|
each individual distro and/or installation. Some custom policy files
|
|
can be found below: </para>
|
|
<screen><ulink url="http://home.iprimus.com.au/glombowski/blfs/twpol-all.txt"/>
|
|
Checks integrity of all files
|
|
<ulink url="http://home.iprimus.com.au/glombowski/blfs/twpol-lfs.txt"/>
|
|
Custom policy file for Base LFS 3.0 system
|
|
<ulink url="http://home.iprimus.com.au/glombowski/blfs/twpol-suse7.2.txt"/>
|
|
Custom policy file for SuSE 7.2 system</screen>
|
|
|
|
<para>Download the custom policy file you'd like to try, copy it into
|
|
<filename>/etc/tripwire/</filename>, and use it instead of <filename>twpol.txt</filename>. It
|
|
is, however, recommended that you make your own policy file. Get ideas
|
|
from the examples above and read
|
|
<filename>/usr/share/doc/tripwire/policyguide.txt</filename>.
|
|
<filename>twpol.txt</filename> is a good policy file for beginners as it will note any changes to the filesystem and can even be used as an annoying way of keeping track of changes for uninstallation of software.</para>
|
|
|
|
<para>After your policy file has been transferred to <filename>/etc/tripwire/</filename> you may begin the configuration steps:</para>
|
|
|
|
<screen><userinput>twadmin -m P /etc/tripwire/twpol.txt &&
|
|
tripwire -m i</userinput></screen>
|
|
|
|
<para>During configuration tripwire will create 2 keys: a site key and
|
|
a local key which will be stored in <filename class="directory">/etc/tripwire/</filename>.</para>
|
|
|
|
</sect3>
|
|
|
|
<sect3><title>Usage Information</title>
|
|
<para>To use tripwire after this and run a report using the following command:
|
|
|
|
<screen><userinput>tripwire -m c > /etc/tripwire/report.txt</userinput></screen></para>
|
|
|
|
<para>View the output to check the integrity of your files. An automatic
|
|
integrity report can be produced by using fcron. </para>
|
|
|
|
<para>Please note that after you run an integrity check, you must check
|
|
the report or email and then modify the tripwire database of the files
|
|
on your system so that tripwire will not continually notify you that
|
|
files you intentionally changed are a security violation. To do this you
|
|
must first <userinput>ls /var/lib/tripwire/report/</userinput> and note
|
|
the name of the newest file which starts with
|
|
<filename>linux-</filename> and ends in <filename>.twr</filename>. This
|
|
encrypted file was created during the last report creation and is needed
|
|
to update the tripwire database of your system. Then, type in the
|
|
following command making the appropriate substitutions for '?':
|
|
<screen><userinput>tripwire -m u -r /var/lib/tripwire/report/linux-???????-??????.twr</userinput></screen></para>
|
|
|
|
<para>You will be placed into vim with a copy of the report in front of
|
|
you. If all the changes were good, then just type
|
|
<userinput>:x</userinput> and after entering your local key, the
|
|
database will be updated. If there are files which you
|
|
still want to be warned about, please remove the x before the filename
|
|
in the report and type <userinput>:x</userinput>. </para>
|
|
|
|
</sect3>
|
|
|
|
<sect3><title>Changing the Policy File</title>
|
|
|
|
<para>If you are unhappy with your policy file and would like to modify it or use a new one, modify the policy file and then execute the following commands:
|
|
<screen><userinput>twadmin -m P /etc/tripwire/twpol.txt &&
|
|
tripwire -m i</userinput></screen></para>
|
|
|
|
</sect3>
|
|
|
|
</sect2>
|
|
|