source: postlfs/security/tripwire.xml@ 5cd0959d

10.0 10.1 11.0 6.0 6.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 ken/refactor-virt krejzi/svn lazarus nosym perl-modules qt5new systemd-11177 systemd-13485 trunk xry111/git-date xry111/git-date-for-trunk xry111/git-date-test
Last change on this file since 5cd0959d was 5cd0959d, checked in by Archaic <archaic@…>, 17 years ago

Resetting keywords

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@2592 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 8.6 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN"
3 "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY tripwire-download-http "http://prdownloads.sourceforge.net/tripwire/tripwire-&tripwire-version;.tar.gz">
8 <!ENTITY tripwire-download-ftp "ftp://ftp.fu-berlin.de/unix/security/tripwire/tripwire-&tripwire-version;.tar.gz">
9 <!ENTITY tripwire-size "1.4 MB">
10 <!ENTITY tripwire-buildsize "63 MB">
11 <!ENTITY tripwire-time "2.35 SBU">
12]>
13
14<sect1 id="tripwire" xreflabel="Tripwire-&tripwire-version;">
15<sect1info>
16<othername>$LastChangedBy$</othername>
17<date>$Date$</date>
18</sect1info>
19<?dbhtml filename="tripwire.html"?>
20<title>Tripwire-&tripwire-version;</title>
21
22<sect2>
23<title>Introduction to <application>Tripwire</application></title>
24
25<para>The <application>Tripwire</application> package contains programs used
26to verify the integrity of the files on a given system.</para>
27
28<sect3><title>Package information</title>
29<itemizedlist spacing='compact'>
30<listitem><para>Download (HTTP): <ulink
31url="&tripwire-download-http;"/></para></listitem>
32<listitem><para>Download (FTP): <ulink
33url="&tripwire-download-ftp;"/></para></listitem>
34<listitem><para>Download size: &tripwire-size;</para></listitem>
35<listitem><para>Estimated Disk space required:
36&tripwire-buildsize;</para></listitem>
37<listitem><para>Estimated build time:
38&tripwire-time;</para></listitem></itemizedlist>
39</sect3>
40
41<sect3><title>Additional downloads</title>
42<itemizedlist spacing='compact'>
43<listitem><para>Required patch to fix multiple build issues (see patch for
44more information): <ulink
45url="&patch-root;/tripwire-&tripwire-version;-gcc3_build_fixes-1.patch"/></para></listitem>
46</itemizedlist>
47</sect3>
48
49<sect3><title><application>Tripwire</application> dependencies</title>
50<sect4><title>Optional</title>
51<para><acronym>MTA</acronym> (See <xref linkend="server-mail"/>)</para></sect4>
52</sect3>
53
54</sect2>
55
56<sect2>
57<title>Installation of <application>Tripwire</application></title>
58
59<para>Compile <application>Tripwire</application> by running the following
60commands:</para>
61
62<screen><userinput><command>patch -Np1 -i ../tripwire-&tripwire-version;-gcc3_build_fixes-1.patch &amp;&amp;
63make -C src release &amp;&amp;
64cp install/install.{sh,cfg} .</command></userinput></screen>
65
66<para>The default configuration is to use a local <acronym>MTA</acronym>. If
67you don't have an <acronym>MTA</acronym> installed and have no wish to install
68one, modify <filename>install.cfg</filename> to use an <acronym>SMTP</acronym>
69server instead. Install <application>Tripwire</application> by running the
70following commands:</para>
71
72<screen><userinput><command>./install.sh &amp;&amp;
73cp /etc/tripwire/tw.cfg /usr/sbin &amp;&amp;
74cp policy/*.txt /usr/share/doc/tripwire</command></userinput></screen>
75
76</sect2>
77
78<sect2>
79<title>Command explanations</title>
80
81<para><command>make release</command>: This command creates the
82<application>Tripwire</application> binaries.</para>
83
84<para><command>cp install.{sh,cfg} .</command>: These files are copied to
85the main <application>Tripwire</application> directory so that the script
86can be used to install the package.</para>
87
88<para><command>cp policy/*.txt /usr/share/doc/tripwire</command>: This command
89installs the documentation.</para>
90
91</sect2>
92
93<sect2>
94<title>Configuring <application>Tripwire</application></title>
95
96<sect3><title>Config files</title>
97<para><filename>/etc/tripwire/*</filename></para>
98</sect3>
99
100<sect3><title>Configuration Information</title>
101
102<para><application>Tripwire</application> uses a policy file to determine which
103files are integrity checked. The default policy file
104(<filename>/etc/tripwire/twpol.txt</filename>) is for a default
105installation of Redhat 7.0 and is woefully outdated.</para>
106
107<para>Policy files are also a custom thing and should be tailored to each
108individual distribution and/or installation. Some custom policy files can be
109found below: </para>
110
111<screen><ulink url="http://home.iprimus.com.au/glombowski/blfs/twpol-all.txt"/>
112Checks integrity of all files
113<ulink url="http://home.iprimus.com.au/glombowski/blfs/twpol-lfs.txt"/>
114Custom policy file for Base LFS 3.0 system
115<ulink url="http://home.iprimus.com.au/glombowski/blfs/twpol-suse7.2.txt"/>
116Custom policy file for SuSE 7.2 system</screen>
117
118<para>Download the custom policy file you'd like to try, copy it into
119<filename class="directory">/etc/tripwire/</filename>, and use it instead of
120<filename>twpol.txt</filename>. It is, however, recommended that you make
121your own policy file. Get ideas from the examples above and read
122<filename>/usr/share/doc/tripwire/policyguide.txt</filename> for additional
123information. <filename>twpol.txt</filename> is a good policy file for beginners
124as it will note any changes to the file system and can even be used as an
125annoying way of keeping track of changes for uninstallation of software.</para>
126
127<para>After your policy file has been transferred to
128<filename class="directory">/etc/tripwire/</filename> you may begin the
129configuration steps:</para>
130
131<screen><userinput><command>twadmin -m P /etc/tripwire/twpol.txt &amp;&amp;
132tripwire -m i</command></userinput></screen>
133
134<para>During installation <application>Tripwire</application> will create two
135keys: a site key and a local key which are stored in
136<filename class="directory">/etc/tripwire/</filename>.</para>
137
138</sect3>
139
140<sect3><title>Usage Information</title>
141<para>To use <application>Tripwire</application> after creating a policy file
142to run a report, use the following command:</para>
143
144<screen><userinput><command>tripwire -m c &gt; /etc/tripwire/report.txt</command></userinput></screen>
145
146<para>View the output to check the integrity of your files. An automatic
147integrity report can be produced by using a cron facility to schedule
148the runs.</para>
149
150<para>Please note that after you run an integrity check, you must examine
151the report (or email) and then modify the <application>Tripwire</application>
152database to reflect the changed files on your system. This is so that
153<application>Tripwire</application> will not continually notify you that
154files you intentionally changed are a security violation. To do this you
155must first <command>ls -l /var/lib/tripwire/report/</command> and note
156the name of the newest file which starts with <filename>linux-</filename> and
157ends in <filename>.twr</filename>. This encrypted file was created during the
158last report creation and is needed to update the
159<application>Tripwire</application> database of your
160system. Then, type in the following command making the appropriate
161substitutions for <replaceable>[?]</replaceable>:</para>
162
163<screen><userinput><command>tripwire -m u -r /var/lib/tripwire/report/linux-<replaceable>[???????]</replaceable>-<replaceable>[??????]</replaceable>.twr</command></userinput></screen>
164
165<para>You will be placed into <application>vim</application> with a copy of
166the report in front of you. If all the changes were good, then just type
167<command>:x</command> and after entering your local key, the database will be
168updated. If there are files which you still want to be warned about, remove the
169'x' before the filename in the report and type <command>:x</command>.</para>
170
171</sect3>
172
173<sect3><title>Changing the Policy File</title>
174
175<para>If you are unhappy with your policy file and would like to modify it or
176use a new one, modify the policy file and then execute the following
177commands:</para>
178
179<screen><userinput><command>twadmin -m P /etc/tripwire/twpol.txt &amp;&amp;
180tripwire -m i</command></userinput></screen>
181
182</sect3>
183
184</sect2>
185
186<sect2>
187<title>Contents</title>
188
189<para>The <application>Tripwire</application> package contains
190<command>siggen</command>, <command>tripwire</command>,
191<command>twadmin</command> and <command>twprint</command>.</para>
192
193</sect2>
194
195<sect2>
196<title>Description</title>
197
198<sect3>
199<title>siggen</title>
200<para><command>siggen</command> is a signature gathering utility that displays
201the hash function values for the specified files.</para></sect3>
202
203<sect3>
204<title>tripwire</title>
205<para><command>tripwire</command> is the main file integrity checking program.
206</para></sect3>
207
208<sect3>
209<title>twadmin</title>
210<para><command>twadmin</command> is <application>Tripwire</application>'s
211administrative and utility tool used to perform certain administrative
212functions related to <application>Tripwire</application> files and
213configuration options.</para></sect3>
214
215<sect3>
216<title>twprint</title>
217<para><command>twprint</command> prints <application>Tripwire</application>
218database and report files in clear text format.</para></sect3>
219
220</sect2>
221
222</sect1>
223
Note: See TracBrowser for help on using the repository browser.