source: postlfs/security/tripwire.xml@ d140e26

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.0 6.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since d140e26 was d140e26, checked in by Randy McMurchy <randy@…>, 20 years ago

misc. corrections and fixes

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@2347 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 7.8 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN"
3 "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY tripwire-download-http "http://prdownloads.sourceforge.net/tripwire/tripwire-&tripwire-version;.tar.gz">
8 <!ENTITY tripwire-download-ftp "ftp://ftp.fu-berlin.de/unix/security/tripwire/tripwire-&tripwire-version;.tar.gz">
9 <!ENTITY tripwire-size "1.4 MB">
10 <!ENTITY tripwire-buildsize "63 MB">
11 <!ENTITY tripwire-time "2.35 SBU">
12]>
13
14<sect1 id="tripwire" xreflabel="Tripwire-&tripwire-version;">
15<?dbhtml filename="tripwire.html"?>
16<title>Tripwire-&tripwire-version;</title>
17
18<sect2>
19<title>Introduction to <application>Tripwire</application></title>
20
21<para>The <application>Tripwire</application> package contains the programs
22used by <application>Tripwire</application> to verify the integrity of the
23files on a given system.</para>
24
25<sect3><title>Package information</title>
26<itemizedlist spacing='compact'>
27<listitem><para>Download (HTTP): <ulink
28url="&tripwire-download-http;"/></para></listitem>
29<listitem><para>Download (FTP): <ulink
30url="&tripwire-download-ftp;"/></para></listitem>
31<listitem><para>Download size: &tripwire-size;</para></listitem>
32<listitem><para>Estimated Disk space required:
33&tripwire-buildsize;</para></listitem>
34<listitem><para>Estimated build time:
35&tripwire-time;</para></listitem></itemizedlist>
36</sect3>
37
38<sect3><title>Additional downloads</title>
39<itemizedlist spacing='compact'>
40<listitem><para>Required patch to fix multiple build issues (see patch for more information):
41<ulink url="&patch-root;/tripwire-&tripwire-version;-gcc3-build-fixes.patch"/></para></listitem>
42</itemizedlist>
43</sect3>
44
45<sect3><title><application>Tripwire</application> dependencies</title>
46<sect4><title>Optional</title>
47<para>MTA (See <xref linkend="server-mail"/>)</para></sect4>
48</sect3>
49
50</sect2>
51
52
53<sect2>
54<title>Installation of <application>Tripwire</application></title>
55
56<para>Compile <application>Tripwire</application> by running the following
57commands:</para>
58
59<screen><userinput><command>patch -Np1 -i ../tripwire-&tripwire-version;-gcc3-build-fixes.patch &amp;&amp;
60make -C src release &amp;&amp;
61cp install/install.{sh,cfg} .</command></userinput></screen>
62
63<para>The default configuration is to use a local MTA. If you don't have
64an MTA installed and have no wish to install one, modify
65<filename>install.cfg</filename> to use an SMTP server instead.
66Install <application>Tripwire</application> by running the following
67commands:</para>
68
69<screen><userinput><command>./install.sh &amp;&amp;
70cp /etc/tripwire/tw.cfg /usr/sbin &amp;&amp;
71cp policy/*.txt /usr/share/doc/tripwire</command></userinput></screen>
72
73</sect2>
74
75<sect2>
76<title>Command explanations</title>
77
78<para><command>make release</command>: This command creates the
79<application>Tripwire</application> binaries.</para>
80
81<para><command>cp install.{sh,cfg} .</command>: These files are copied to
82the main <application>Tripwire</application> directory so that the script
83can be used to install the package.</para>
84
85<para><command>cp policy/*.txt /usr/share/doc/tripwire</command>: This command
86installs the documentation.</para>
87
88</sect2>
89
90<sect2>
91<title>Configuring <application>Tripwire</application></title>
92
93<sect3><title>Config files</title>
94<para><filename class="directory">/etc/tripwire</filename></para>
95</sect3>
96
97<sect3><title>Configuration Information</title>
98
99<para><application>Tripwire</application> uses a policy file to determine which
100files are integrity checked. The default policy file (<filename>twpol.txt
101</filename> found in <filename class="directory">/etc/tripwire/</filename>) is for a default
102installation of Redhat 7.0 and is woefully outdated.</para>
103
104<para>Policy files are also a custom thing and should be tailored to each
105individual distribution and/or installation. Some custom policy files can be
106found below: </para>
107<screen><ulink url="http://home.iprimus.com.au/glombowski/blfs/twpol-all.txt">http://home.iprimus.com.au/glombowski/blfs/twpol-all.txt</ulink>
108Checks integrity of all files
109<ulink url="http://home.iprimus.com.au/glombowski/blfs/twpol-lfs.txt">http://home.iprimus.com.au/glombowski/blfs/twpol-lfs.txt</ulink>
110Custom policy file for Base LFS 3.0 system
111<ulink url="http://home.iprimus.com.au/glombowski/blfs/twpol-suse7.2.txt">http://home.iprimus.com.au/glombowski/blfs/twpol-suse7.2.txt</ulink>
112Custom policy file for SuSE 7.2 system</screen>
113
114<para>Download the custom policy file you'd like to try, copy it into
115<filename class="directory">/etc/tripwire/</filename>, and use it instead of
116<filename>twpol.txt</filename>. It is, however, recommended that you make
117your own policy file. Get ideas from the examples above and read
118<filename> /usr/share/doc/tripwire/policyguide.txt</filename>.
119<filename>twpol.txt</filename> is a good policy file for beginners as it
120will note any changes to the file system and can even be used as an annoying
121way of keeping track of changes for uninstallation of software.</para>
122
123<para>After your policy file has been transferred to <filename
124class="directory">/etc/tripwire/</filename> you may begin the configuration
125steps:</para>
126
127<screen><userinput><command>twadmin -m P /etc/tripwire/twpol.txt &amp;&amp;
128tripwire -m i</command></userinput></screen>
129
130<para>During installation <application>Tripwire</application> will create two
131(2) keys: a site key and a local key which will be stored in <filename
132class="directory">/etc/tripwire/</filename>.</para>
133
134</sect3>
135
136<sect3><title>Usage Information</title>
137<para>To use <application>Tripwire</application> after this and run a report,
138use the following command:</para>
139
140<screen><userinput><command>tripwire -m c &gt; /etc/tripwire/report.txt</command></userinput></screen>
141
142<para>View the output to check the integrity of your files. An automatic
143integrity report can be produced by using a cron facility to schedule
144the runs. </para>
145
146<para>Please note that after you run an integrity check, you must examine
147the report (or email) and then modify the <application>Tripwire</application>
148database to reflect the changed files on your system. This is so that
149<application>Tripwire</application> will not continually notify you that
150files you intentionally changed are a security violation. To do this you
151must first <command>ls -l /var/lib/tripwire/report/</command> and note
152the name of the newest file which starts with <filename>linux-</filename> and
153ends in <filename>.twr</filename>. This encrypted file was created during the
154last report creation and is needed to update the
155<application>Tripwire</application> database of your
156system. Then, type in the following command making the appropriate
157substitutions for '?':</para>
158<screen><userinput><command>tripwire -m u -r /var/lib/tripwire/report/linux-???????-??????.twr </command></userinput></screen>
159
160<para>You will be placed into vim with a copy of the report in front of you. If
161all the changes were good, then just type <command>:x</command> and after
162entering your local key, the database will be updated. If there are files which
163you still want to be warned about, remove the x before the filename in
164the report and type <command>:x</command>.</para>
165
166</sect3>
167
168<sect3><title>Changing the Policy File</title>
169
170<para>If you are unhappy with your policy file and would like to modify it or
171use a new one, modify the policy file and then execute the following
172commands:</para>
173<screen><userinput><command>twadmin -m P /etc/tripwire/twpol.txt &amp;&amp;
174tripwire -m i</command></userinput></screen>
175
176</sect3>
177
178</sect2>
179
180<sect2>
181<title>Contents</title>
182
183<para>The <application>Tripwire</application> package contains
184<command>siggen</command>, <command>tripwire</command>,
185<command>twadmin</command> and <command>twprint</command>.</para>
186
187</sect2>
188
189</sect1>
190
Note: See TracBrowser for help on using the repository browser.