Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 152)

152 Chapter 12. Installing and Conﬁguring Tripwire

12.6. Selecting Passphrases

Tripwire ﬁles are signed or encrypted using site and local keys, which protect the conﬁguration, policy,

database, and report ﬁles from being viewed or altered except by users who know the site and/or local

passphrases. This means that, even if an intruder can obtain root access to your system, they will not

be able to alter the Tripwire ﬁles to hide their tracks unless they also know the passphrases. When

selecting passphrases, you must use at least eight alphanumeric and symbolic characters for each

passphrase. The maximum length of a passphrase is 1023 characters. Quotes should not be used as

passphrase characters. Also, make sure that your passphrases are completely different from the root

password for the system.

You should assign unique passphrases for both the site key and the local key. The site key passphrase

protects the site key, which is used to sign Tripwire conﬁguration and policy ﬁles. The local key signs

Tripwire database and report ﬁles.

Caution

Store the passphrases in a secure location. There is no way to decrypt a signed ﬁle if you forget

your passphrase. If you forget the passphrases, the ﬁles are unusable and you will have to run the

conﬁguration script again, which also reinitializes the Tripwire database.

12.7. Initializing the Database

When initializing its database, Tripwire builds a collection of ﬁlesystem objects based on the rules in

the policy ﬁle. This database serves as the baseline for integrity checks.

To initialize the Tripwire database, use the following command:

/usr/sbin/tripwire --init

This command can take several minutes to run.

12.8. Running an Integrity Check

When running an integrity check, Tripwire compares the current, actual ﬁlesystem objects with their

properties as recorded in its database. Violations are printed to standard output and saved in a report

ﬁle that can be accessed later by twprint. For more information on viewing Tripwire reports, see

Section 12.9.

An email conﬁguration option in the policy ﬁle even allows particular email addresses to be sent

notices when certain integrity violations occur. See Section 12.12 for instructions on how to set this

up.

To run an integrity check, use the following command:

/usr/sbin/tripwire --check

This command requires some time to run in most situations, depending upon the number of ﬁles to be

checked.

1 2 ... 147 148 149 150 151 152 153 154 155 156 157 ... 281 282

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 152