source: postlfs/security/tripwire.xml@ 197d9d4

10.0 10.1 11.0 6.0 6.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 ken/refactor-virt krejzi/svn lazarus nosym perl-modules qt5new systemd-11177 systemd-13485 trunk upgradedb xry111/git-date xry111/git-date-for-trunk xry111/git-date-test
Last change on this file since 197d9d4 was 197d9d4, checked in by Bruce Dubbs <bdubbs@…>, 17 years ago

minor fixes to xorg and popt. Change spacing in template for maintainability.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@3339 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 8.4 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN"
3 "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY tripwire-download-http "http://www.frenchfries.net/paul/tripwire/tripwire-&tripwire-version;.tar.gz">
8 <!ENTITY tripwire-download-ftp " ">
9 <!ENTITY tripwire-size "869 KB">
10 <!ENTITY tripwire-buildsize "22 MB">
11 <!ENTITY tripwire-time "2.96 SBU">
12]>
13
14<sect1 id="tripwire-portable" xreflabel="Tripwire-&tripwire-version;">
15<sect1info>
16<othername>$LastChangedBy$</othername>
17<date>$Date$</date>
18</sect1info>
19<?dbhtml filename="tripwire.html"?>
20<title>Tripwire-&tripwire-version;</title>
21
22<sect2>
23<title>Introduction to <application>Tripwire</application></title>
24
25<para>The <application>Tripwire</application> package contains programs used
26to verify the integrity of the files on a given system.</para>
27
28<sect3><title>Package information</title>
29<itemizedlist spacing='compact'>
30<listitem><para>Download (HTTP): <ulink
31url="&tripwire-download-http;"/></para></listitem>
32<listitem><para>Download (FTP): <ulink
33url="&tripwire-download-ftp;"/></para></listitem>
34<listitem><para>Download size: &tripwire-size;</para></listitem>
35<listitem><para>Estimated disk space required:
36&tripwire-buildsize;</para></listitem>
37<listitem><para>Estimated build time:
38&tripwire-time;</para></listitem></itemizedlist>
39</sect3>
40
41<sect3><title><application>Tripwire</application> dependencies</title>
42<sect4><title>Optional</title>
43<para><acronym>MTA</acronym> (See <xref linkend="server-mail"/>)</para></sect4>
44</sect3>
45
46</sect2>
47
48<sect2>
49<title>Installation of <application>Tripwire</application></title>
50
51<para>Compile <application>Tripwire</application> by running the following
52commands:</para>
53
54<screen><userinput><command>sed -i -e 's@TWDB="${prefix}@TWDB="/var@' install/install.cfg &amp;&amp;
55./configure --prefix=/usr --sysconfdir=/etc/tripwire &amp;&amp;
56make &amp;&amp;
57make install &amp;&amp;
58cp policy/*.txt /usr/share/doc/tripwire</command></userinput></screen>
59
60<para>The default configuration is to use a local <acronym>MTA</acronym>. If
61you don't have an <acronym>MTA</acronym> installed and have no wish to install
62one, modify <filename>install.cfg</filename> to use an <acronym>SMTP</acronym>
63server instead.</para>
64
65</sect2>
66
67<sect2>
68<title>Command explanations</title>
69
70<para><command>sed -i -e 's@TWDB="${prefix}@TWDB="/var@'
71install/install.cfg</command>: This command tells the package to install the
72program database and reports in
73<filename>/var/lib/tripwire</filename>.</para>
74
75<para><command>make install</command>: This command creates the
76<application>Tripwire</application> security keys as well as installing the
77binaries. There are two keys: a site key and a local key which are stored in
78<filename class="directory">/etc/tripwire/</filename>.</para>
79
80<para><command>cp policy/*.txt /usr/share/doc/tripwire</command>: This command
81installs the documentation.</para>
82
83</sect2>
84
85<sect2>
86<title>Configuring <application>Tripwire</application></title>
87
88<sect3><title>Config files</title>
89<para><filename>/etc/tripwire/*</filename></para>
90</sect3>
91
92<sect3><title>Configuration Information</title>
93
94<para><application>Tripwire</application> uses a policy file to determine which
95files are integrity checked. The default policy file
96(<filename>/etc/tripwire/twpol.txt</filename>) is for a default
97installation Redhat and will need to be updated for your system.</para>
98
99<para>Policy files should be tailored to each individual distribution and/or
100installation. Some custom policy files can be found below: </para>
101
102<screen><ulink url="http://home.iprimus.com.au/glombowski/blfs/twpol-all.txt"/>
103Checks integrity of all files
104<ulink url="http://home.iprimus.com.au/glombowski/blfs/twpol-lfs.txt"/>
105Custom policy file for Base LFS 3.0 system
106<ulink url="http://home.iprimus.com.au/glombowski/blfs/twpol-suse7.2.txt"/>
107Custom policy file for SuSE 7.2 system</screen>
108
109<para>Download the custom policy file you'd like to try, copy it into
110<filename class="directory">/etc/tripwire/</filename>, and use it instead of
111<filename>twpol.txt</filename>. It is, however, recommended that you make
112your own policy file. Get ideas from the examples above and read
113<filename>/usr/share/doc/tripwire/policyguide.txt</filename> for additional
114information. <filename>twpol.txt</filename> is a good policy file for beginners
115as it will note any changes to the file system and can even be used as an
116annoying way of keeping track of changes for uninstallation of software.</para>
117
118<para>After your policy file has been transferred to
119<filename class="directory">/etc/tripwire/</filename> you may begin the
120configuration steps:</para>
121
122<screen><userinput><command>twadmin --create-polfile --site-keyfile /etc/tripwire/site.key \
123 /etc/tripwire/twpol.txt &amp;&amp;
124tripwire --init</command></userinput></screen>
125
126</sect3>
127
128<sect3><title>Usage Information</title>
129<para>To use <application>Tripwire</application> after creating a policy file
130to run a report, use the following command:</para>
131
132<screen><userinput><command>tripwire --check &gt; /etc/tripwire/report.txt</command></userinput></screen>
133
134<para>View the output to check the integrity of your files. An automatic
135integrity report can be produced by using a cron facility to schedule
136the runs.</para>
137
138<para>Please note that after you run an integrity check, you must examine
139the report (or email) and then modify the <application>Tripwire</application>
140database to reflect the changed files on your system. This is so that
141<application>Tripwire</application> will not continually notify you that
142files you intentionally changed are a security violation. To do this you
143must first <command>ls -l /var/lib/tripwire/report/</command> and note
144the name of the newest file which starts with <filename>linux-</filename> and
145ends in <filename>.twr</filename>. This encrypted file was created during the
146last report creation and is needed to update the
147<application>Tripwire</application> database of your
148system. Then, type in the following command making the appropriate
149substitutions for <replaceable>[?]</replaceable>:</para>
150
151<screen><userinput><command>tripwire --update -twrfile \
152 /var/lib/tripwire/report/linux-<replaceable>[???????]</replaceable>-<replaceable>[??????]</replaceable>.twr</command></userinput></screen>
153
154<para>You will be placed into <application>vim</application> with a copy of
155the report in front of you. If all the changes were good, then just type
156<command>:x</command> and after entering your local key, the database will be
157updated. If there are files which you still want to be warned about, remove the
158'x' before the filename in the report and type <command>:x</command>.</para>
159
160</sect3>
161
162<sect3><title>Changing the Policy File</title>
163
164<para>If you are unhappy with your policy file and would like to modify it or
165use a new one, modify the policy file and then execute the following
166commands:</para>
167
168<screen><userinput><command>twadmin --create-polfile /etc/tripwire/twpol.txt &amp;&amp;
169tripwire --init</command></userinput></screen>
170
171</sect3>
172
173</sect2>
174
175<sect2>
176<title>Contents</title>
177<segmentedlist>
178 <segtitle>Installed Programs</segtitle>
179 <seglistitem>
180 <seg>siggen, tripwire, twadmin and twprint.</seg>
181 </seglistitem>
182</segmentedlist>
183
184<variablelist>
185 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
186 <?dbfo list-presentation="list"?>
187
188 <varlistentry id="siggen">
189 <term><command>siggen</command></term>
190 <listitem><para>is a signature gathering utility that displays
191 the hash function values for the specified files.</para>
192 </listitem>
193 </varlistentry>
194
195 <varlistentry id='tripwire'>
196 <term><command>tripwire</command></term>
197 <listitem><para>is the main file integrity checking program.</para></listitem>
198 </varlistentry>
199
200 <varlistentry id='twadmin'>
201 <term><command>twadmin</command></term>
202 <listitem><para>administrative and utility tool used to perform
203 certain administrative functions related to
204 <application>Tripwire</application> files and configuration options.</para>
205 </listitem>
206 </varlistentry>
207
208 <varlistentry id='twprint'>
209 <term><command>twprint</command></term>
210 <listitem><para>prints <application>Tripwire</application>
211 database and report files in clear text format.</para>
212 </listitem>
213 </varlistentry>
214</variablelist>
215
216</sect2>
217
218</sect1>
219
Note: See TracBrowser for help on using the repository browser.