HOWTO Setup Tripwire: Difference between revisions
Jump to navigation
Jump to search
No edit summary |
|||
| Line 9: | Line 9: | ||
=== Generate a Report === | === Generate a Report === | ||
<font color=red>hostname</font> <font color=blue>~ #</font> '''tripwire --check''' | |||
=== File System Error Messages === | === File System Error Messages === | ||
| Line 15: | Line 15: | ||
To get rid of "File system error." messages where the file or folder does not exist, comment out the culprits from /etc/tripwire/twpol.txt Then, update the policy file, delete and re-init the db: | To get rid of "File system error." messages where the file or folder does not exist, comment out the culprits from /etc/tripwire/twpol.txt Then, update the policy file, delete and re-init the db: | ||
<font color=red>hostname</font> <font color=blue>~ #</font> '''twadmin --create-polfile -S /etc/tripwire/site.key /etc/tripwire/twpol.txt''' | |||
<font color=red>hostname</font> <font color=blue>~ #</font> '''rm /var/lib/tripwire/$hostname.twd''' | |||
<font color=red>hostname</font> <font color=blue>~ #</font> '''tripwire --init''' | |||
Now, run a check, followed by an update. This shifts files around, which will be flagged as "changed" on the next run, so re-run the check/update: | Now, run a check, followed by an update. This shifts files around, which will be flagged as "changed" on the next run, so re-run the check/update: | ||
<font color=red>hostname</font> <font color=blue>~ #</font> '''tripwire --check''' | |||
<font color=red>hostname</font> <font color=blue>~ #</font> '''tripwire --update --twrfile /var/lib/tripwire/report/hosname_date_time.twr''' | |||
<font color=red>hostname</font> <font color=blue>~ #</font> '''tripwire --check''' | |||
<font color=red>hostname</font> <font color=blue>~ #</font> '''tripwire --update --twrfile /var/lib/tripwire/report/hosname_date_time.twr''' | |||
=== After System Changes === | === After System Changes === | ||
| Line 30: | Line 30: | ||
After you emerge packages or change config files: | After you emerge packages or change config files: | ||
<font color=red>hostname</font> <font color=blue>~ #</font> '''tripwire --update --twrfile /var/lib/tripwire/report/a_previous_integrity_report.twr''' | |||
=== Tidying Up === | |||
After a while, the /var/log/tripwire/report/ directory becomes quite large. At some point, these historical reports are of no value, so they can be deleted. One guideline might be to blow away anything more than 6 months old. | |||
Revision as of 18:11, 26 October 2006
Setting Up a Tripwire Installation
# emerge tripwire # cd /etc/tripwire # tripwire --init # twadmin --create-polfile twpol.txt # twadmin --create-polfile -S hostname-local.key twpol.txt
Generate a Report
hostname ~ # tripwire --check
File System Error Messages
To get rid of "File system error." messages where the file or folder does not exist, comment out the culprits from /etc/tripwire/twpol.txt Then, update the policy file, delete and re-init the db:
hostname ~ # twadmin --create-polfile -S /etc/tripwire/site.key /etc/tripwire/twpol.txt hostname ~ # rm /var/lib/tripwire/$hostname.twd hostname ~ # tripwire --init
Now, run a check, followed by an update. This shifts files around, which will be flagged as "changed" on the next run, so re-run the check/update:
hostname ~ # tripwire --check hostname ~ # tripwire --update --twrfile /var/lib/tripwire/report/hosname_date_time.twr hostname ~ # tripwire --check hostname ~ # tripwire --update --twrfile /var/lib/tripwire/report/hosname_date_time.twr
After System Changes
After you emerge packages or change config files:
hostname ~ # tripwire --update --twrfile /var/lib/tripwire/report/a_previous_integrity_report.twr
Tidying Up
After a while, the /var/log/tripwire/report/ directory becomes quite large. At some point, these historical reports are of no value, so they can be deleted. One guideline might be to blow away anything more than 6 months old.