Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 150)

150 Chapter 12. Installing and Conﬁguring Tripwire

1. If you already know of several changes that should be made to the conﬁguration ﬁle

(/etc/tripwire/twcfg.txt) or the policy ﬁle (/etc/tripwire/twpol.txt), edit those

ﬁles now.

Note

While you should edit your conﬁguration and policy ﬁles to customize Tripwire to your particu-

lar situation, editing the conﬁguration or policy ﬁles is not required to use Tripwire. If you plan

to modify the conﬁguration or policy ﬁles, you must make these changes before running the

conﬁguration script (/etc/tripwire/twinstall.sh). If you modify the conﬁguration or policy

ﬁles after running the conﬁguration script, you must re-run the conﬁguration script before ini-

tializing the database ﬁle. Keep in mind that you can edit the conﬁguration and policy ﬁles after

initializing the database ﬁle and running an integrity check.

2. Type /etc/tripwire/twinstall.sh at the command line as root and press [Enter] to run

the conﬁguration script. The twinstall.sh script walks you through the processes of setting

passphrases, generating the cryptographic keys that protect the Tripwire conﬁguration and pol-

icy ﬁles, and signing these ﬁles. See Section 12.6 for more information on setting passphrases.

Note

Once encoded and signed, the conﬁguration ﬁle (/etc/tripwire/tw.cfg) and policy ﬁle

(/etc/tripwire/tw.pol) generated by running the /etc/tripwire/twinstall.sh script

should not be renamed or moved.

3. Initialize the Tripwire database ﬁle by issuing the /usr/sbin/tripwire --init command

at the command line.

4. Run the ﬁrst integrity check comparing your new Tripwire database to your system ﬁles by

issuing the /usr/sbin/tripwire --check command at the command line and looking for

errors in the generated report.

Once you ﬁnish these steps successfully, Tripwire has the baseline snapshot of your ﬁlesystem that

it needs to check for changes to critical ﬁles. Additionally, the tripwire RPM adds a ﬁle called

tripwire-check to the /etc/cron.daily directory that will automatically run an integrity check

once per day.

12.3. File Locations

Before working with Tripwire, you should know where important ﬁles for the application are located.

Tripwire stores its ﬁles in a variety of places depending on their role:

• The /usr/sbin directory stores the tripwire, twadmin, and twprint programs.

• The /etc/tripwire directory contains the local and site keys (*.key ﬁles) and the initialization

script (twinstall.sh), as well as the sample and actual conﬁguration and policy ﬁles.

• The /var/lib/tripwire directory contains the Tripwire database of your system’s ﬁles

(*.twd) and a report directory where Tripwire reports are stored. The Tripwire reports, named

host_name-date_of_report-time_of_report.twr, detail the differences between the

Tripwire database and your actual system ﬁles.

1 2 ... 145 146 147 148 149 150 151 152 153 154 155 ... 281 282

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 150