Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 156)

156 Chapter 12. Installing and Conﬁguring Tripwire

does not have a /etc/smb.conf ﬁle, you can tell Tripwire not to try to look for it by commenting

out its line in twpol.txt:

# /etc/smb.conf -> $(SEC_CONFIG) ;

Next, you must tell Tripwire to generate a new /etc/tripwire/tw.pol signed ﬁle

and then generate an updated database ﬁle based on this policy information. Assuming

/etc/tripwire/twpol.txt is the edited policy ﬁle, use this command:

/usr/sbin/twadmin --create-polfile -S site.key /etc/tripwire/twpol.txt

You will be asked for the site passphrase. Then, the twpol.txt ﬁle will be parsed and signed.

It is important that you update the Tripwire database after creating a new /etc/tripwire/tw.pol

ﬁle. The most reliable way to accomplish this is to delete your current Tripwire database and create a

new database using the new policy ﬁle.

If your Tripwire database ﬁle is named wilbur.domain.com.twd, type this command:

rm /var/lib/tripwire/wilbur.domain.com.twd

Then type the command to create a new database:

/usr/sbin/tripwire --init

A new database will be created according to the instructions in the new policy ﬁle. To make sure the

database was correctly changed, run the ﬁrst integrity check manually and view the contents of the

resulting report. See Section 12.8 and Section 12.9 for speciﬁc instructions on these points.

12.11.1. Signing the Conﬁguration File

The text ﬁle with the conﬁguration ﬁle changes (commonly /etc/tripwire/twcfg.txt) must be

signed to replace the /etc/tripwire/tw.cfg and be used by Tripwire when it runs its integrity

check. Tripwire will not recognize any conﬁguration changes until the conﬁguration text ﬁle is cor-

rectly signed and used to replace the /etc/tripwire/tw.pol ﬁle.

If your altered conﬁguration text ﬁle is /etc/tripwire/twcfg.txt, type this command to sign it,

replacing the current /etc/tripwire/tw.cfg ﬁle:

/usr/sbin/twadmin --create-cfgfile -S site.key /etc/tripwire/twcfg.txt

Since the conﬁguration ﬁle does not not alter any Tripwire policies or ﬁles tracked by the application,

it is not necessary to regenerate the database of monitored system ﬁles.

12.12. Tripwire and Email

Tripwire can email someone if a speciﬁc type of rule in the policy ﬁle is violated. To conﬁgure Trip-

wire to do this, you ﬁrst have to know the email address of the person to be contacted if a particular

integrity violation occurs, plus the name of the rule you would like to monitor. Note that on large sys-

tems with multiple administrators, you can have different sets of people notiﬁed for certain violations

and no one notiﬁed for minor violations.

Once you know who to notify and what to notify them about, add an emailto= line to the rule directive

section of each rule. Do this by adding a comma after the severity= line and putting emailto= on the

next line, followed by the email addresses to send the violation reports for that rule. Multiple emails

will be sent if more than one email address is speciﬁed and they are separated by a semi-colon.

1 2 ... 151 152 153 154 155 156 157 158 159 160 161 ... 281 282

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 156