source: postlfs/security/tripwire.xml@ 724c103

10.0 10.1 11.0 11.1 11.2 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind lazarus perl-modules qt5new trunk upgradedb xry111/intltool xry111/soup3 xry111/test-20220226
Last change on this file since 724c103 was 724c103, checked in by Bruce Dubbs <bdubbs@…>, 6 years ago

Update to mc-4.8.19.
Update to harfbuzz-1.4.4.
Update to tripwire-2.4.3.4.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@18446 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 14.0 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY tripwire-download-http "https://github.com/Tripwire/tripwire-open-source/archive/&tripwire-version;.tar.gz">
8 <!ENTITY tripwire-download-ftp " ">
9 <!ENTITY tripwire-md5sum "7d93ed95b3a2aa45431481b7cc0e5d7a">
10 <!ENTITY tripwire-size "948 KB">
11 <!ENTITY tripwire-buildsize "28 MB">
12 <!ENTITY tripwire-time "1.2 SBU (scripting install)">
13]>
14
15<sect1 id="tripwire" xreflabel="Tripwire-&tripwire-version;">
16 <?dbhtml filename="tripwire.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Tripwire-&tripwire-version;</title>
24
25 <indexterm zone="tripwire">
26 <primary sortas="a-Tripwire">Tripwire</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Tripwire</title>
31
32 <para>The <application>Tripwire</application> package contains programs
33 used to verify the integrity of the files on a given system.</para>
34
35 &lfs80_checked;
36
37 <bridgehead renderas="sect3">Package Information</bridgehead>
38 <itemizedlist spacing="compact">
39 <listitem>
40 <para>Download (HTTP): <ulink url="&tripwire-download-http;"/></para>
41 </listitem>
42 <listitem>
43 <para>Download (FTP): <ulink url="&tripwire-download-ftp;"/></para>
44 </listitem>
45 <listitem>
46 <para>Download MD5 sum: &tripwire-md5sum;</para>
47 </listitem>
48 <listitem>
49 <para>Download size: &tripwire-size;</para>
50 </listitem>
51 <listitem>
52 <para>Estimated disk space required: &tripwire-buildsize;</para>
53 </listitem>
54 <listitem>
55 <para>Estimated build time: &tripwire-time;</para>
56 </listitem>
57 </itemizedlist>
58
59 <note>
60 <para>
61 The <application>tripwire</application> source tarball shown above
62 downloads with the correct name, tripwire-open-source-&tripwire-version;.tar.gz,
63 if using a browser such as Firefox. If you prefer to use a command line
64 program such as wget, you normally would obtain
65 &tripwire-version;.tar.gz. To obtain this package with the proper
66 filename, run:
67
68<screen><userinput>wget -c https://github.com/Tripwire/tripwire-open-source/archive/&tripwire-version;.tar.gz \
69 -O tripwire-open-source-&tripwire-version;.tar.gz</userinput></screen>.
70 </para>
71 </note>
72
73 <bridgehead renderas="sect3">Tripwire Dependencies</bridgehead>
74
75 <bridgehead renderas="sect4">Recommended</bridgehead>
76 <para role="recommended"><xref linkend="openssl"/></para>
77
78
79 <bridgehead renderas="sect4">Optional</bridgehead>
80 <para role="optional">An <xref linkend="server-mail"/></para>
81
82 <para condition="html" role="usernotes">User Notes:
83 <ulink url="&blfs-wiki;/tripwire"/></para>
84
85 </sect2>
86
87 <sect2 role="installation">
88 <title>Installation of Tripwire</title>
89
90 <para>Compile <application>Tripwire</application> by running the following
91 commands:</para>
92
93<screen><userinput>sed -e 's|TWDB="${prefix}|TWDB="/var|' \
94 -e '/TWMAN/ s|${prefix}|/usr/share|' \
95 -e '/TWDOCS/s|${prefix}/doc/tripwire|/usr/share/doc/tripwire-&tripwire-version;|' \
96 -i installer/install.cfg &amp;&amp;
97find . -name Makefile.am | xargs \
98 sed -i 's/^[[:alpha:]_]*_HEADERS.*=/noinst_HEADERS =/' &amp;&amp;
99sed '/dist/d' -i man/man?/Makefile.am &amp;&amp;
100autoreconf -fi &amp;&amp;
101
102./configure --prefix=/usr --sysconfdir=/etc/tripwire &amp;&amp;
103make</userinput></screen>
104
105 <note><para>The default configuration is to use a local MTA. If
106 you don't have an MTA installed and have no wish to install
107 one, modify <filename>install/install.cfg</filename> to use an SMTP
108 server instead. Otherwise the install will fail.</para></note>
109
110 <para>This package does not come with a test suite.</para>
111
112 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
113
114<screen role="root"><userinput>make install &amp;&amp;
115cp -v policy/*.txt /usr/share/doc/tripwire-&tripwire-version;</userinput></screen>
116
117 <note>
118 <para>
119 During <command>make install</command>, several questions
120 are asked, including passwords. If you want to make a script, you have
121 to apply a <application>sed</application> before running
122 <command>make install</command>:
123 </para>
124
125<screen><userinput>sed -i -e 's@installer/install.sh@&amp; -n -s <replaceable>&lt;site-password&gt;</replaceable> -l <replaceable>&lt;local-password&gt;</replaceable>@' Makefile</userinput></screen>
126
127 <para>
128 Of course, you should do this with dummy passwords and change them
129 later.
130 </para>
131
132 <para>
133 Another issue when scripting is that the installer exits when the
134 standard input is not a terminal. You may disable this behavior
135 with the following sed:
136 </para>
137
138<screen><userinput>sed '/-t 0/,+3d' -i installer/install.sh</userinput></screen>
139
140 </note>
141
142 </sect2>
143
144 <sect2 role="commands">
145 <title>Command Explanations</title>
146
147 <para>
148 <command>sed ... installer/install.cfg</command>: This command tells
149 the package to install the program database and reports in
150 <filename class="directory">/var/lib/tripwire</filename> and sets the
151 proper location for man pages and documentation.
152 </para>
153
154 <para>
155 <command>find ...</command>, <command>sed ...</command>, and
156 <command>autoreconf -fi</command>: The build system is unusable as is, and
157 has to be modified for the build to succeed.
158 </para>
159
160 <para>
161 <command>make install</command>: This command creates the
162 <application>Tripwire</application> security keys as well as installing
163 the binaries. There are two keys: a site key and a local key which are
164 stored in <filename class="directory">/etc/tripwire/</filename>.
165 </para>
166
167 <para>
168 <command>cp -v policy/*.txt /usr/doc/tripwire-&tripwire-version;</command>:
169 This command installs the <application>tripwire</application> sample
170 policy files with the other <application>tripwire</application>
171 documentation.i
172 </para>
173
174 </sect2>
175
176 <sect2 role="configuration">
177 <title>Configuring Tripwire</title>
178
179 <sect3 id="tripwire-config">
180 <title>Config Files</title>
181
182 <para><filename>/etc/tripwire/*</filename></para>
183
184 <indexterm zone="tripwire tripwire-config">
185 <primary sortas="e-etc-tripwire">/etc/tripwire/*</primary>
186 </indexterm>
187
188 </sect3>
189
190 <sect3>
191 <title>Configuration Information</title>
192
193 <para><application>Tripwire</application> uses a policy file to
194 determine which files are integrity checked. The default policy
195 file (<filename>/etc/tripwire/twpol.txt</filename>) is for a
196 default installation and will need to be updated for your
197 system.</para>
198
199 <para>Policy files should be tailored to each individual distribution
200 and/or installation. Some example policy files can be found in <filename
201 class="directory">/usr/share/doc/tripwire/</filename>.</para>
202
203 <para>If desired, copy the policy file you'd like to try into <filename
204 class="directory">/etc/tripwire/</filename> instead of using the default
205 policy file, <filename>twpol.txt</filename>. It is, however, recommended
206 that you edit your policy file. Get ideas from the examples above and
207 read <filename>/usr/share/doc/tripwire/policyguide.txt</filename> for
208 additional information. <filename>twpol.txt</filename> is a good policy
209 file for learning about <application>Tripwire</application> as it will
210 note any changes to the file system and can even be used as an annoying
211 way of keeping track of changes for uninstallation of software.</para>
212
213 <para>After your policy file has been edited to your satisfaction you may
214 begin the configuration steps (perform as the <systemitem
215 class='username'>root</systemitem>) user:</para>
216
217<screen role="root"><userinput>twadmin --create-polfile --site-keyfile /etc/tripwire/site.key \
218 /etc/tripwire/twpol.txt &amp;&amp;
219tripwire --init</userinput></screen>
220
221 <para>Depending on your system and the contents of the policy file, the
222 initialization phase above can take a relatively long time.</para>
223
224 </sect3>
225
226 <sect3>
227 <title>Usage Information</title>
228
229 <para><application>Tripwire</application> will identify file changes in
230 the critical system files specified in the policy file. Using
231 <application>Tripwire</application> while making frequent changes to
232 these directories will flag all these changes. It is most useful after a
233 system has reached a configuration that the user considers stable.</para>
234
235 <para>To use <application>Tripwire</application> after creating a policy
236 file to run a report, use the following command:</para>
237
238<screen role="root"><userinput>tripwire --check &gt; /etc/tripwire/report.txt</userinput></screen>
239
240 <para>View the output to check the integrity of your files. An automatic
241 integrity report can be produced by using a cron facility to schedule the
242 runs.</para>
243
244 <para>Reports are stored in binary and, if desired, encrypted. View reports,
245 as the <systemitem class="username">root</systemitem> user, with:</para>
246
247<screen role="root"><userinput>twprint --print-report -r /var/lib/tripwire/report/<replaceable>&lt;report-name.twr&gt;</replaceable></userinput></screen>
248
249 <para>After you run an integrity check, you should examine the
250 report (or email) and then modify the <application>Tripwire</application>
251 database to reflect the changed files on your system. This is so that
252 <application>Tripwire</application> will not continually notify you that
253 files you intentionally changed are a security violation. To do this you
254 must first <command>ls -l /var/lib/tripwire/report/</command> and note
255 the name of the newest file which starts with your system name as
256 presented by the command <userinput>uname -n</userinput>
257 and ends in <filename>.twr</filename>. These files were created
258 during report creation and the most current one is needed to update the
259 <application>Tripwire</application> database of your system. As the
260 <systemitem class='username'>root</systemitem> user, type in the
261 following command making the appropriate report name:</para>
262
263<screen role="root"><userinput>tripwire --update --twrfile /var/lib/tripwire/report/<replaceable>&lt;report-name.twr&gt;</replaceable></userinput></screen>
264
265 <para>You will be placed into <application>Vim</application> with a copy
266 of the report in front of you. If all the changes were good, then just
267 type <command>:wq</command> and after entering your local key, the database
268 will be updated. If there are files which you still want to be warned
269 about, remove the 'x' before the filename in the report and type
270 <command>:wq</command>.</para>
271
272 <!-- 10-12-2013 bad URL and no good URL found
273 <para>A good summary of tripwire operations can be found at
274 <ulink url="http://va-holladays.no-ip.info:2200/tools/security-docs/tripwire-v1.0.pdf"/>.</para>
275 -->
276 </sect3>
277
278 <sect3>
279 <title>Changing the Policy File</title>
280
281 <para>If you are unhappy with your policy file and would like to modify
282 it or use a new one, modify the policy file and then execute the following
283 commands as the <systemitem class='username'>root</systemitem> user:</para>
284
285<screen role="root"><userinput>twadmin --create-polfile /etc/tripwire/twpol.txt &amp;&amp;
286tripwire --init</userinput></screen>
287
288 </sect3>
289
290 </sect2>
291
292 <sect2 role="content">
293 <title>Contents</title>
294
295 <segmentedlist>
296 <segtitle>Installed Programs</segtitle>
297 <segtitle>Installed Libraries</segtitle>
298 <segtitle>Installed Directories</segtitle>
299
300 <seglistitem>
301 <seg>siggen, tripwire, twadmin, and twprint</seg>
302 <seg>None</seg>
303 <seg>/etc/tripwire, /var/lib/tripwire,
304 and /usr/share/doc/tripwire-&tripwire-version;</seg>
305 </seglistitem>
306 </segmentedlist>
307
308 <variablelist>
309 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
310 <?dbfo list-presentation="list"?>
311 <?dbhtml list-presentation="table"?>
312
313 <varlistentry id="siggen">
314 <term><command>siggen</command></term>
315 <listitem>
316 <para>is a signature gathering utility that displays
317 the hash function values for the specified files.</para>
318 <indexterm zone="tripwire siggen">
319 <primary sortas="b-siggen">siggen</primary>
320 </indexterm>
321 </listitem>
322 </varlistentry>
323
324 <varlistentry id="tripwire-program">
325 <term><command>tripwire</command></term>
326 <listitem>
327 <para>is the main file integrity checking program.</para>
328 <indexterm zone="tripwire tripwire">
329 <primary sortas="b-tripwire">tripwire</primary>
330 </indexterm>
331 </listitem>
332 </varlistentry>
333
334 <varlistentry id="twadmin">
335 <term><command>twadmin</command></term>
336 <listitem>
337 <para>administrative and utility tool used to perform
338 certain administrative functions related to
339 <application>Tripwire</application> files and configuration
340 options.</para>
341 <indexterm zone="tripwire twadmin">
342 <primary sortas="b-twadmin">twadmin</primary>
343 </indexterm>
344 </listitem>
345 </varlistentry>
346
347 <varlistentry id="twprint">
348 <term><command>twprint</command></term>
349 <listitem>
350 <para>prints <application>Tripwire</application>
351 database and report files in clear text format.</para>
352 <indexterm zone="tripwire twprint">
353 <primary sortas="b-twprint">twprint</primary>
354 </indexterm>
355 </listitem>
356 </varlistentry>
357
358 </variablelist>
359
360 </sect2>
361
362</sect1>
Note: See TracBrowser for help on using the repository browser.