source: postlfs/security/tripwire.xml@ fdcbc8d

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 12.2 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gimp3 gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/for-12.3 xry111/intltool xry111/llvm18 xry111/soup3 xry111/spidermonkey128 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since fdcbc8d was fdcbc8d, checked in by Bruce Dubbs <bdubbs@…>, 13 years ago

Updated to tripwire-2.4.2.2

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@9081 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 11.8 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY tripwire-download-http "&sourceforge-repo;/tripwire/tripwire-&tripwire-version;-src.tar.bz2">
8 <!ENTITY tripwire-download-ftp " ">
9 <!ENTITY tripwire-md5sum "2462ea16fb0b5ae810471011ad2f2dd6">
10 <!ENTITY tripwire-size "704 KB">
11 <!ENTITY tripwire-buildsize "31 MB">
12 <!ENTITY tripwire-time "1.3 SBU (includes interactive time during install)">
13]>
14
15<sect1 id="tripwire" xreflabel="Tripwire-&tripwire-version;">
16 <?dbhtml filename="tripwire.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Tripwire-&tripwire-version;</title>
24
25 <indexterm zone="tripwire">
26 <primary sortas="a-Tripwire">Tripwire</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Tripwire</title>
31
32 <para>The <application>Tripwire</application> package contains programs
33 used to verify the integrity of the files on a given system.</para>
34
35 &lfs70_checked;
36
37 <bridgehead renderas="sect3">Package Information</bridgehead>
38 <itemizedlist spacing="compact">
39 <listitem>
40 <para>Download (HTTP): <ulink url="&tripwire-download-http;"/></para>
41 </listitem>
42 <listitem>
43 <para>Download (FTP): <ulink url="&tripwire-download-ftp;"/></para>
44 </listitem>
45 <listitem>
46 <para>Download MD5 sum: &tripwire-md5sum;</para>
47 </listitem>
48 <listitem>
49 <para>Download size: &tripwire-size;</para>
50 </listitem>
51 <listitem>
52 <para>Estimated disk space required: &tripwire-buildsize;</para>
53 </listitem>
54 <listitem>
55 <para>Estimated build time: &tripwire-time;</para>
56 </listitem>
57 </itemizedlist>
58
59 <bridgehead renderas="sect3">Tripwire Dependencies</bridgehead>
60
61 <bridgehead renderas="sect4">Required</bridgehead>
62 <para role="required"><xref linkend="openssl"/></para>
63
64
65 <bridgehead renderas="sect4">Optional</bridgehead>
66 <para role="optional">An <xref linkend="server-mail"/></para>
67
68 <para condition="html" role="usernotes">User Notes:
69 <ulink url="&blfs-wiki;/tripwire"/></para>
70
71 </sect2>
72
73 <sect2 role="installation">
74 <title>Installation of Tripwire</title>
75
76 <para>Compile <application>Tripwire</application> by running the following
77 commands:</para>
78
79<screen><userinput>sed -i -e 's@TWDB="${prefix}@TWDB="/var@' install/install.cfg &amp;&amp;
80./configure --prefix=/usr --sysconfdir=/etc/tripwire &amp;&amp;
81make</userinput></screen>
82
83 <warning><para>The default configuration is to use a local MTA. If
84 you don't have an MTA installed and have no wish to install
85 one, modify <filename>install/install.cfg</filename> to use an SMTP
86 server instead. Otherwise the install will fail.</para></warning>
87
88 <para>This package does not come with a test suite.</para>
89
90 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
91
92<screen role="root"><userinput>make install &amp;&amp;
93cp -v policy/*.txt /usr/doc/tripwire</userinput></screen>
94
95 </sect2>
96
97 <sect2 role="commands">
98 <title>Command Explanations</title>
99
100 <para><command>sed -i -e 's@TWDB="${prefix}@TWDB="/var@'
101 install/install.cfg</command>: This command tells the package to install
102 the program database and reports in
103 <filename class="directory">/var/lib/tripwire</filename>.</para>
104
105 <para><command>make install</command>: This command creates the
106 <application>Tripwire</application> security keys as well as installing
107 the binaries. There are two keys: a site key and a local key which are
108 stored in <filename class="directory">/etc/tripwire/</filename>.</para>
109
110 <para><command>cp -v policy/*.txt /usr/doc/tripwire</command>: This command
111 installs the <application>tripwire</application> sample policy files with
112 the other <application>tripwire</application> documentation.</para>
113
114 </sect2>
115
116 <sect2 role="configuration">
117 <title>Configuring Tripwire</title>
118
119 <sect3 id="tripwire-config">
120 <title>Config Files</title>
121
122 <para><filename>/etc/tripwire/*</filename></para>
123
124 <indexterm zone="tripwire tripwire-config">
125 <primary sortas="e-etc-tripwire">/etc/tripwire/*</primary>
126 </indexterm>
127
128 </sect3>
129
130 <sect3>
131 <title>Configuration Information</title>
132
133 <para><application>Tripwire</application> uses a policy file to
134 determine which files are integrity checked. The default policy
135 file (<filename>/etc/tripwire/twpol.txt</filename>) is for a
136 default installation and will need to be updated for your
137 system.</para>
138
139 <para>Policy files should be tailored to each individual distribution
140 and/or installation. Some example policy files can be found in <filename
141 class="directory">/usr/doc/tripwire/</filename> (Note that <filename
142 class="directory">/usr/doc/</filename> is a symbolic link on LFS systems
143 to <filename class="directory">/usr/share/doc/</filename>).</para>
144
145 <para>If desired, copy the policy file you'd like to try into <filename
146 class="directory">/etc/tripwire/</filename> instead of using the default
147 policy file, <filename>twpol.txt</filename>. It is, however, recommended
148 that you edit your policy file. Get ideas from the examples above and
149 read <filename>/usr/doc/tripwire/policyguide.txt</filename> for
150 additional information. <filename>twpol.txt</filename> is a good policy
151 file for learning about <application>Tripwire</application> as it will
152 note any changes to the file system and can even be used as an annoying
153 way of keeping track of changes for uninstallation of software.</para>
154
155 <para>After your policy file has been edited to your satisfaction you may
156 begin the configuration steps (perform as the <systemitem
157 class='username'>root</systemitem>) user:</para>
158
159<screen role="root"><userinput>twadmin --create-polfile --site-keyfile /etc/tripwire/site.key \
160 /etc/tripwire/twpol.txt &amp;&amp;
161tripwire --init</userinput></screen>
162
163 <para>Depending on your system and the contents of the policy file, the
164 initialization phase above can take a relatively long time.</para>
165
166 </sect3>
167
168 <sect3>
169 <title>Usage Information</title>
170
171 <para><application>Tripwire</application> will identify file changes in
172 the critical system files specified in the policy file. Using
173 <application>Tripwire</application> while making frequent changes to
174 these directories will flag all these changes. It is most useful after a
175 system has reached a configuration that the user considers stable.</para>
176
177 <para>To use <application>Tripwire</application> after creating a policy
178 file to run a report, use the following command:</para>
179
180<screen role="root"><userinput>tripwire --check &gt; /etc/tripwire/report.txt</userinput></screen>
181
182 <para>View the output to check the integrity of your files. An automatic
183 integrity report can be produced by using a cron facility to schedule the
184 runs.</para>
185
186 <para>Reports are stored in binary and, if desired, encrypted. View reports,
187 as the <systemitem class="username">root</systemitem> user, with:</para>
188
189<screen role="root">twprint --print-report -r /var/lib/tripwire/report/<replaceable>&lt;report-name.twr&gt;</replaceable></screen>
190
191 <para>After you run an integrity check, you should examine the
192 report (or email) and then modify the <application>Tripwire</application>
193 database to reflect the changed files on your system. This is so that
194 <application>Tripwire</application> will not continually notify you that
195 files you intentionally changed are a security violation. To do this you
196 must first <command>ls -l /var/lib/tripwire/report/</command> and note
197 the name of the newest file which starts with your system name as
198 presented by the command <userinput>uname -n</userinput>
199 and ends in <filename>.twr</filename>. These files were created
200 during report creation and the most current one is needed to update the
201 <application>Tripwire</application> database of your system. As the
202 <systemitem class='username'>root</systemitem> user, type in the
203 following command making the appropriate report name:</para>
204
205<screen role="root"><userinput>tripwire --update --twrfile /var/lib/tripwire/report/<replaceable>&lt;report-name.twr&gt;</replaceable></userinput></screen>
206
207 <para>You will be placed into <application>Vim</application> with a copy
208 of the report in front of you. If all the changes were good, then just
209 type <command>:wq</command> and after entering your local key, the database
210 will be updated. If there are files which you still want to be warned
211 about, remove the 'x' before the filename in the report and type
212 <command>:wq</command>.</para>
213
214 <para>A good summary of tripwire operations can be found at
215 <ulink url="http://va-holladays.no-ip.info:2200/tools/security-docs/tripwire-v1.0.pdf"/>.</para>
216
217 </sect3>
218
219 <sect3>
220 <title>Changing the Policy File</title>
221
222 <para>If you are unhappy with your policy file and would like to modify
223 it or use a new one, modify the policy file and then execute the following
224 commands as the <systemitem class='username'>root</systemitem> user:</para>
225
226<screen role="root"><userinput>twadmin --create-polfile /etc/tripwire/twpol.txt &amp;&amp;
227tripwire --init</userinput></screen>
228
229 </sect3>
230
231 </sect2>
232
233 <sect2 role="content">
234 <title>Contents</title>
235
236 <segmentedlist>
237 <segtitle>Installed Programs</segtitle>
238 <segtitle>Installed Libraries</segtitle>
239 <segtitle>Installed Directories</segtitle>
240
241 <seglistitem>
242 <seg>siggen, tripwire, twadmin, and twprint</seg>
243 <seg>None</seg>
244 <seg>/etc/tripwire, /var/lib/tripwire, and /usr/share/doc/tripwire</seg>
245 </seglistitem>
246 </segmentedlist>
247
248 <variablelist>
249 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
250 <?dbfo list-presentation="list"?>
251 <?dbhtml list-presentation="table"?>
252
253 <varlistentry id="siggen">
254 <term><command>siggen</command></term>
255 <listitem>
256 <para>is a signature gathering utility that displays
257 the hash function values for the specified files.</para>
258 <indexterm zone="tripwire siggen">
259 <primary sortas="b-siggen">siggen</primary>
260 </indexterm>
261 </listitem>
262 </varlistentry>
263
264 <varlistentry id='tripwire-program'>
265 <term><command>tripwire</command></term>
266 <listitem>
267 <para>is the main file integrity checking program.</para>
268 <indexterm zone="tripwire tripwire">
269 <primary sortas="b-tripwire">tripwire</primary>
270 </indexterm>
271 </listitem>
272 </varlistentry>
273
274 <varlistentry id='twadmin'>
275 <term><command>twadmin</command></term>
276 <listitem>
277 <para>administrative and utility tool used to perform
278 certain administrative functions related to
279 <application>Tripwire</application> files and configuration
280 options.</para>
281 <indexterm zone="tripwire twadmin">
282 <primary sortas="b-twadmin">twadmin</primary>
283 </indexterm>
284 </listitem>
285 </varlistentry>
286
287 <varlistentry id='twprint'>
288 <term><command>twprint</command></term>
289 <listitem>
290 <para>prints <application>Tripwire</application>
291 database and report files in clear text format.</para>
292 <indexterm zone="tripwire twprint">
293 <primary sortas="b-twprint">twprint</primary>
294 </indexterm>
295 </listitem>
296 </varlistentry>
297
298 </variablelist>
299
300 </sect2>
301
302</sect1>
Note: See TracBrowser for help on using the repository browser.