source: postlfs/security/tripwire.xml@ be2215e

10.0 10.1 11.0 8.4 9.0 9.1 ken/refactor-virt lazarus qt5new trunk xry111/git-date xry111/git-date-for-trunk xry111/git-date-test
Last change on this file since be2215e was be2215e, checked in by Bruce Dubbs <bdubbs@…>, 3 years ago

Tag packages in postlfs part

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@21199 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 14.1 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY tripwire-download-http "https://github.com/Tripwire/tripwire-open-source/releases/download/&tripwire-version;/tripwire-open-source-&tripwire-version;.tar.gz">
8 <!ENTITY tripwire-download-ftp " ">
9 <!ENTITY tripwire-md5sum "a5cf1bc2f235f5d8ca458f00548db6ee">
10 <!ENTITY tripwire-size "980 KB">
11 <!ENTITY tripwire-buildsize "29 MB">
12 <!ENTITY tripwire-time "1.6 SBU (scripting install)">
13]>
14
15<sect1 id="tripwire" xreflabel="Tripwire-&tripwire-version;">
16 <?dbhtml filename="tripwire.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Tripwire-&tripwire-version;</title>
24
25 <indexterm zone="tripwire">
26 <primary sortas="a-Tripwire">Tripwire</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Tripwire</title>
31
32 <para>The <application>Tripwire</application> package contains programs
33 used to verify the integrity of the files on a given system.</para>
34
35 &lfs84_checked;
36
37 <bridgehead renderas="sect3">Package Information</bridgehead>
38 <itemizedlist spacing="compact">
39 <listitem>
40 <para>Download (HTTP): <ulink url="&tripwire-download-http;"/></para>
41 </listitem>
42 <listitem>
43 <para>Download (FTP): <ulink url="&tripwire-download-ftp;"/></para>
44 </listitem>
45 <listitem>
46 <para>Download MD5 sum: &tripwire-md5sum;</para>
47 </listitem>
48 <listitem>
49 <para>Download size: &tripwire-size;</para>
50 </listitem>
51 <listitem>
52 <para>Estimated disk space required: &tripwire-buildsize;</para>
53 </listitem>
54 <listitem>
55 <para>Estimated build time: &tripwire-time;</para>
56 </listitem>
57 </itemizedlist>
58<!--
59 <note>
60 <para>
61 The <application>tripwire</application> source tarball shown above
62 downloads with the correct name, tripwire-open-source-&tripwire-version;.tar.gz,
63 if using a browser such as Firefox. If you prefer to use a command line
64 program such as wget, you normally would obtain
65 &tripwire-version;.tar.gz. To obtain this package with the proper
66 filename, run:
67
68<screen><userinput>wget -c https://github.com/Tripwire/tripwire-open-source/archive/&tripwire-version;.tar.gz \
69 -O tripwire-open-source-&tripwire-version;.tar.gz</userinput></screen>.
70 </para>
71 </note>
72-->
73 <bridgehead renderas="sect3">Tripwire Dependencies</bridgehead>
74<!--
75 <bridgehead renderas="sect4">Recommended</bridgehead>
76 <para role="recommended"><xref linkend="openssl"/></para>
77-->
78
79 <bridgehead renderas="sect4">Optional</bridgehead>
80 <para role="optional">An <xref linkend="server-mail"/></para>
81
82 <para condition="html" role="usernotes">User Notes:
83 <ulink url="&blfs-wiki;/tripwire"/></para>
84
85 </sect2>
86
87 <sect2 role="installation">
88 <title>Installation of Tripwire</title>
89
90 <para>Compile <application>Tripwire</application> by running the following
91 commands:</para>
92
93<screen><userinput>sed -e '/^CLOBBER/s/false/true/' \
94 -e 's|TWDB="${prefix}|TWDB="/var|' \
95 -e '/TWMAN/ s|${prefix}|/usr/share|' \
96 -e '/TWDOCS/s|${prefix}/doc/tripwire|/usr/share/doc/tripwire-&tripwire-version;|' \
97 -i installer/install.cfg &amp;&amp;
98
99find . -name Makefile.am | xargs \
100 sed -i 's/^[[:alpha:]_]*_HEADERS.*=/noinst_HEADERS =/' &amp;&amp;
101
102sed '/dist/d' -i man/man?/Makefile.am &amp;&amp;
103autoreconf -fi &amp;&amp;
104
105./configure --prefix=/usr --sysconfdir=/etc/tripwire &amp;&amp;
106make</userinput></screen>
107
108 <note><para>The default configuration is to use a local MTA. If
109 you don't have an MTA installed and have no wish to install
110 one, modify <filename>install/install.cfg</filename> to use an SMTP
111 server instead. Otherwise the install will fail.</para></note>
112
113 <para>This package does not come with a test suite.</para>
114
115 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
116
117<screen role="root"><userinput>make install &amp;&amp;
118cp -v policy/*.txt /usr/share/doc/tripwire-&tripwire-version;</userinput></screen>
119
120 <note>
121 <para>
122 During <command>make install</command>, several questions
123 are asked, including passwords. If you want to make a script, you have
124 to apply a <application>sed</application> before running
125 <command>make install</command>:
126 </para>
127
128<screen><userinput>sed -i -e 's@installer/install.sh@&amp; -n -s <replaceable>&lt;site-password&gt;</replaceable> -l <replaceable>&lt;local-password&gt;</replaceable>@' Makefile</userinput></screen>
129
130 <para>
131 Of course, you should do this with dummy passwords and change them
132 later.
133 </para>
134
135 <para>
136 Another issue when scripting is that the installer exits when the
137 standard input is not a terminal. You may disable this behavior
138 with the following sed:
139 </para>
140
141<screen><userinput>sed '/-t 0/,+3d' -i installer/install.sh</userinput></screen>
142
143 </note>
144
145 </sect2>
146
147 <sect2 role="commands">
148 <title>Command Explanations</title>
149
150 <para>
151 <command>sed ... installer/install.cfg</command>: This command tells
152 the package to install the program database and reports in
153 <filename class="directory">/var/lib/tripwire</filename> and sets the
154 proper location for man pages and documentation.
155 </para>
156
157 <para>
158 <command>find ...</command>, <command>sed ...</command>, and
159 <command>autoreconf -fi</command>: The build system is unusable as is, and
160 has to be modified for the build to succeed.
161 </para>
162
163 <para>
164 <command>make install</command>: This command creates the
165 <application>Tripwire</application> security keys as well as installing
166 the binaries. There are two keys: a site key and a local key which are
167 stored in <filename class="directory">/etc/tripwire/</filename>.
168 </para>
169
170 <para>
171 <command>cp -v policy/*.txt /usr/doc/tripwire-&tripwire-version;</command>:
172 This command installs the <application>tripwire</application> sample
173 policy files with the other <application>tripwire</application>
174 documentation.i
175 </para>
176
177 </sect2>
178
179 <sect2 role="configuration">
180 <title>Configuring Tripwire</title>
181
182 <sect3 id="tripwire-config">
183 <title>Config Files</title>
184
185 <para><filename>/etc/tripwire/*</filename></para>
186
187 <indexterm zone="tripwire tripwire-config">
188 <primary sortas="e-etc-tripwire">/etc/tripwire/*</primary>
189 </indexterm>
190
191 </sect3>
192
193 <sect3>
194 <title>Configuration Information</title>
195
196 <para><application>Tripwire</application> uses a policy file to
197 determine which files are integrity checked. The default policy
198 file (<filename>/etc/tripwire/twpol.txt</filename>) is for a
199 default installation and will need to be updated for your
200 system.</para>
201
202 <para>Policy files should be tailored to each individual distribution
203 and/or installation. Some example policy files can be found in <filename
204 class="directory">/usr/share/doc/tripwire/</filename>.</para>
205
206 <para>If desired, copy the policy file you'd like to try into <filename
207 class="directory">/etc/tripwire/</filename> instead of using the default
208 policy file, <filename>twpol.txt</filename>. It is, however, recommended
209 that you edit your policy file. Get ideas from the examples above and
210 read <filename>/usr/share/doc/tripwire/policyguide.txt</filename> for
211 additional information. <filename>twpol.txt</filename> is a good policy
212 file for learning about <application>Tripwire</application> as it will
213 note any changes to the file system and can even be used as an annoying
214 way of keeping track of changes for uninstallation of software.</para>
215
216 <para>After your policy file has been edited to your satisfaction you may
217 begin the configuration steps (perform as the <systemitem
218 class='username'>root</systemitem>) user:</para>
219
220<screen role="root"><userinput>twadmin --create-polfile --site-keyfile /etc/tripwire/site.key \
221 /etc/tripwire/twpol.txt &amp;&amp;
222tripwire --init</userinput></screen>
223
224 <para>Depending on your system and the contents of the policy file, the
225 initialization phase above can take a relatively long time.</para>
226
227 </sect3>
228
229 <sect3>
230 <title>Usage Information</title>
231
232 <para><application>Tripwire</application> will identify file changes in
233 the critical system files specified in the policy file. Using
234 <application>Tripwire</application> while making frequent changes to
235 these directories will flag all these changes. It is most useful after a
236 system has reached a configuration that the user considers stable.</para>
237
238 <para>To use <application>Tripwire</application> after creating a policy
239 file to run a report, use the following command:</para>
240
241<screen role="root"><userinput>tripwire --check &gt; /etc/tripwire/report.txt</userinput></screen>
242
243 <para>View the output to check the integrity of your files. An automatic
244 integrity report can be produced by using a cron facility to schedule the
245 runs.</para>
246
247 <para>Reports are stored in binary and, if desired, encrypted. View reports,
248 as the <systemitem class="username">root</systemitem> user, with:</para>
249
250<screen role="root"><userinput>twprint --print-report -r /var/lib/tripwire/report/<replaceable>&lt;report-name.twr&gt;</replaceable></userinput></screen>
251
252 <para>After you run an integrity check, you should examine the
253 report (or email) and then modify the <application>Tripwire</application>
254 database to reflect the changed files on your system. This is so that
255 <application>Tripwire</application> will not continually notify you that
256 files you intentionally changed are a security violation. To do this you
257 must first <command>ls -l /var/lib/tripwire/report/</command> and note
258 the name of the newest file which starts with your system name as
259 presented by the command <userinput>uname -n</userinput>
260 and ends in <filename>.twr</filename>. These files were created
261 during report creation and the most current one is needed to update the
262 <application>Tripwire</application> database of your system. As the
263 <systemitem class='username'>root</systemitem> user, type in the
264 following command making the appropriate report name:</para>
265
266<screen role="root"><userinput>tripwire --update --twrfile /var/lib/tripwire/report/<replaceable>&lt;report-name.twr&gt;</replaceable></userinput></screen>
267
268 <para>You will be placed into <application>Vim</application> with a copy
269 of the report in front of you. If all the changes were good, then just
270 type <command>:wq</command> and after entering your local key, the database
271 will be updated. If there are files which you still want to be warned
272 about, remove the 'x' before the filename in the report and type
273 <command>:wq</command>.</para>
274
275 <!-- 10-12-2013 bad URL and no good URL found
276 <para>A good summary of tripwire operations can be found at
277 <ulink url="http://va-holladays.no-ip.info:2200/tools/security-docs/tripwire-v1.0.pdf"/>.</para>
278 -->
279 </sect3>
280
281 <sect3>
282 <title>Changing the Policy File</title>
283
284 <para>If you are unhappy with your policy file and would like to modify
285 it or use a new one, modify the policy file and then execute the following
286 commands as the <systemitem class='username'>root</systemitem> user:</para>
287
288<screen role="root"><userinput>twadmin --create-polfile /etc/tripwire/twpol.txt &amp;&amp;
289tripwire --init</userinput></screen>
290
291 </sect3>
292
293 </sect2>
294
295 <sect2 role="content">
296 <title>Contents</title>
297
298 <segmentedlist>
299 <segtitle>Installed Programs</segtitle>
300 <segtitle>Installed Libraries</segtitle>
301 <segtitle>Installed Directories</segtitle>
302
303 <seglistitem>
304 <seg>siggen, tripwire, twadmin, and twprint</seg>
305 <seg>None</seg>
306 <seg>/etc/tripwire, /var/lib/tripwire,
307 and /usr/share/doc/tripwire-&tripwire-version;</seg>
308 </seglistitem>
309 </segmentedlist>
310
311 <variablelist>
312 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
313 <?dbfo list-presentation="list"?>
314 <?dbhtml list-presentation="table"?>
315
316 <varlistentry id="siggen">
317 <term><command>siggen</command></term>
318 <listitem>
319 <para>is a signature gathering utility that displays
320 the hash function values for the specified files.</para>
321 <indexterm zone="tripwire siggen">
322 <primary sortas="b-siggen">siggen</primary>
323 </indexterm>
324 </listitem>
325 </varlistentry>
326
327 <varlistentry id="tripwire-program">
328 <term><command>tripwire</command></term>
329 <listitem>
330 <para>is the main file integrity checking program.</para>
331 <indexterm zone="tripwire tripwire">
332 <primary sortas="b-tripwire">tripwire</primary>
333 </indexterm>
334 </listitem>
335 </varlistentry>
336
337 <varlistentry id="twadmin">
338 <term><command>twadmin</command></term>
339 <listitem>
340 <para>administrative and utility tool used to perform
341 certain administrative functions related to
342 <application>Tripwire</application> files and configuration
343 options.</para>
344 <indexterm zone="tripwire twadmin">
345 <primary sortas="b-twadmin">twadmin</primary>
346 </indexterm>
347 </listitem>
348 </varlistentry>
349
350 <varlistentry id="twprint">
351 <term><command>twprint</command></term>
352 <listitem>
353 <para>prints <application>Tripwire</application>
354 database and report files in clear text format.</para>
355 <indexterm zone="tripwire twprint">
356 <primary sortas="b-twprint">twprint</primary>
357 </indexterm>
358 </listitem>
359 </varlistentry>
360
361 </variablelist>
362
363 </sect2>
364
365</sect1>
Note: See TracBrowser for help on using the repository browser.