source: postlfs/security/tripwire.xml@ b4b71892

10.0 10.1 11.0 6.0 6.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 ken/refactor-virt krejzi/svn lazarus nosym perl-modules qt5new systemd-11177 systemd-13485 trunk xry111/git-date xry111/git-date-for-trunk xry111/git-date-test
Last change on this file since b4b71892 was b4b71892, checked in by Bruce Dubbs <bdubbs@…>, 17 years ago

New XML Chapter 4

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@2288 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 7.7 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN"
3 "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY tripwire-download-http "http://prdownloads.sourceforge.net/tripwire/tripwire-&tripwire-version;.tar.gz">
8 <!ENTITY tripwire-download-ftp "ftp://ftp.fu-berlin.de/unix/security/tripwire/tripwire-&tripwire-version;.tar.gz">
9 <!ENTITY tripwire-size "1.4 MB">
10 <!ENTITY tripwire-buildsize "63 MB">
11 <!ENTITY tripwire-time "2.35 SBU">
12]>
13
14<sect1 id="tripwire" xreflabel="Tripwire-&tripwire-version;">
15<?dbhtml filename="tripwire.html"?>
16<title>Tripwire-&tripwire-version;</title>
17
18<sect2>
19<title>Introduction to <application>Tripwire</application></title>
20
21<para>The <application>Tripwire</application> package contains the programs
22used by <application>Tripwire</application> to verify the integrity of the
23files on a given system.</para>
24
25<sect3><title>Package information</title>
26<itemizedlist spacing='compact'>
27<listitem><para>Download (HTTP): <ulink
28url="&tripwire-download-http;"/></para></listitem>
29<listitem><para>Download (FTP): <ulink
30url="&tripwire-download-ftp;"/></para></listitem>
31<listitem><para>Download size: &tripwire-size;</para></listitem>
32<listitem><para>Estimated Disk space required:
33&tripwire-buildsize;</para></listitem>
34<listitem><para>Estimated build time:
35&tripwire-time;</para></listitem></itemizedlist>
36</sect3>
37
38<sect3><title>Additional downloads</title>
39<itemizedlist spacing='compact'>
40<listitem><para>Required patch to fix multiple build issues (see patch for more information):
41<ulink url="&patch-root;/tripwire-&tripwire-version;-gcc3-build-fixes.patch"/></para></listitem>
42</itemizedlist>
43</sect3>
44
45<sect3><title><application>Shadow</application> dependencies</title>
46<sect4><title>Optional</title>
47<para>MTA (See <xref linkend="server-mail"/>)</para></sect4>
48</sect3>
49
50</sect2>
51
52
53<sect2>
54<title>Installation of <application>Tripwire</application></title>
55
56<para>Compile <application>Tripwire</application> by running the following
57commands:</para>
58
59<screen><userinput><command>patch -Np1 -i ../tripwire-&tripwire-version;-gcc3-build-fixes.patch &amp;&amp;
60make -C src release &amp;&amp;
61cp install/install.{sh,cfg} .</command></userinput></screen>
62
63<para>The default configuration is to use a local MTA. If you don't have
64a MTA installed and have no wish to install one, modify the
65<filename>install.cfg</filename> to use an SMTP server instead.
66Install <application>Tripwire</application> by running the following
67commands:</para>
68
69<screen><userinput><command>./install.sh &amp;&amp;
70cp /etc/tripwire/tw.cfg /usr/sbin &amp;&amp;
71cp policy/*.txt /usr/share/doc/tripwire</command></userinput></screen>
72
73</sect2>
74
75<sect2>
76<title>Command explanations</title>
77
78<para><command>make release</command>: This command creates the
79<application>Tripwire</application> binaries.</para>
80
81<para><command>cp install.{sh,cfg} .</command>: These are copied to the main
82<application>Tripwire</application> directory so that the script can be used to
83install the package.</para>
84
85<para><command>cp policy/*.txt /usr/share/doc/tripwire</command>: This command
86installs the documentation.</para>
87
88</sect2>
89
90<sect2>
91<title>Configuring <application>Tripwire</application></title>
92
93<sect3><title>Config files</title>
94<para><filename class="directory">/etc/tripwire</filename></para>
95</sect3>
96
97<sect3><title>Configuration Information</title>
98
99<para><application>Tripwire</application> uses a policy file to determine which
100files integrity are checked. The default policy file (<filename>twpol.txt
101</filename> found in <filename class="directory">/etc/tripwire/</filename>) is for a default
102installation of Redhat 7.0 and is woefully outdated.</para>
103
104<para>Policy files are also a custom thing and should be tailored to each
105individual distribution and/or installation. Some custom policy files can be
106found below: </para>
107<screen><ulink url="http://home.iprimus.com.au/glombowski/blfs/twpol-all.txt">http://home.iprimus.com.au/glombowski/blfs/twpol-all.txt</ulink>
108Checks integrity of all files
109<ulink url="http://home.iprimus.com.au/glombowski/blfs/twpol-lfs.txt">http://home.iprimus.com.au/glombowski/blfs/twpol-lfs.txt</ulink>
110Custom policy file for Base LFS 3.0 system
111<ulink url="http://home.iprimus.com.au/glombowski/blfs/twpol-suse7.2.txt">http://home.iprimus.com.au/glombowski/blfs/twpol-suse7.2.txt</ulink>
112Custom policy file for SuSE 7.2 system</screen>
113
114<para>Download the custom policy file you'd like to try, copy it into
115<filename class="directory">/etc/tripwire/</filename>, and use it instead of
116<filename>twpol.txt</filename>. It is, however, recommended that you make your own policy file.
117Get ideas from the examples above and read <filename>
118/usr/share/doc/tripwire/policyguide.txt</filename>. <filename>twpol.txt
119</filename> is a good policy file for beginners as it will note any changes to
120the file system and can even be used as an annoying way of keeping track of
121changes for uninstallation of software.</para>
122
123<para>After your policy file has been transferred to <filename
124class="directory">/etc/tripwire/</filename> you may begin the configuration steps:</para>
125
126<screen><userinput><command>twadmin -m P /etc/tripwire/twpol.txt &amp;&amp;
127tripwire -m i</command></userinput></screen>
128
129<para>During installation <application>Tripwire</application> will create two
130(2) keys: a site key and a local key which will be stored in <filename
131class="directory">/etc/tripwire/</filename>.</para>
132
133</sect3>
134
135<sect3><title>Usage Information</title>
136<para>To use <application>Tripwire</application> after this and run a report,
137use the following command:</para>
138
139<screen><userinput><command>tripwire -m c &gt; /etc/tripwire/report.txt</command></userinput></screen>
140
141<para>View the output to check the integrity of your files. An automatic
142integrity report can be produced by using a cron facility to schedule
143the runs. </para>
144
145<para>Please note that after you run an integrity check, you must check
146the report or email and then modify the
147<application>Tripwire</application> database of the files
148on your system so that <application>Tripwire</application> will not continually notify you that
149files you intentionally changed are a security violation. To do this you
150must first <command>ls -l /var/lib/tripwire/report/</command> and note
151the name of the newest file which starts with <filename>linux-</filename> and
152ends in <filename>.twr</filename>. This encrypted file was created during the
153last report creation and is needed to update the
154<application>Tripwire</application> database of your
155system. Then, type in the following command making the appropriate
156substitutions for '?':</para>
157<screen><userinput><command>tripwire -m u -r /var/lib/tripwire/report/linux-???????-??????.twr </command></userinput></screen>
158
159<para>You will be placed into vim with a copy of the report in front of you. If
160all the changes were good, then just type <command>:x</command> and after
161entering your local key, the database will be updated. If there are files which
162you still want to be warned about, please remove the x before the filename in
163the report and type <command>:x</command>. </para>
164
165</sect3>
166
167<sect3><title>Changing the Policy File</title>
168
169<para>If you are unhappy with your policy file and would like to modify it or
170use a new one, modify the policy file and then execute the following
171commands:</para>
172<screen><userinput><command>twadmin -m P /etc/tripwire/twpol.txt &amp;&amp;
173tripwire -m i</command></userinput></screen>
174
175</sect3>
176
177</sect2>
178
179<sect2>
180<title>Contents</title>
181
182<para>The <application>Tripwire</application> package contains <command>siggen
183</command>,
184<command>tripwire</command>, <command>twadmin</command>
185and <command>twprint</command>.</para>
186
187</sect2>
188
189</sect1>
190
Note: See TracBrowser for help on using the repository browser.