Updating the Tripwire Database


If you run an integrity check and Tripwire finds violations, you will first need to determine whether the violations discovered are actual security breaches or the product of authorized modifications. If you recently installed an application or edited critical system files, Tripwire will correctly report integrity check violations. In this case, you should update your Tripwire database so those changes are no longer reported as violations. However, if unauthorized changes have been made to system files and generate integrity check violations, you should restore the original file from a backup, reinstall the program, or, if the breach is severe enough, completely reinstall the operating system.

To update its database so it accepts valid policy violations, Tripwire first cross-references a report file against the database, then integrates into it valid violations from the report file. When updating the database, be sure to use the most recent report. Use the following command to update the Tripwire database, where name is the name of the most recent report file:

/usr/sbin/tripwire --update --twrfile /var/lib/tripwire/report/name.twr

Tripwire will display the report file using the default text editor specified on the EDITOR line of the Tripwire configuration file. This gives you an opportunity to deselect files you do not wish to update in the Tripwire database.

Note

It is important that you change only authorized integrity violations in the database.

All proposed updates to the Tripwire database start with an [x] before the file name, similar to the following example:

Added: [x] "/usr/sbin/longrun" Modified: [x] "/usr/sbin" [x] "/usr/sbin/cpqarrayd"

If you want to specifically exclude a valid violation from being added to the Tripwire database, remove the [x]. To accept any files with an [x] beside them as changes, or to edit files in the default text editor, vi, type i and press Enter to enter insert mode and make any necessary changes. When finished, press the Esc key, type :wq, and press Enter. After the editor closes, enter your local password, and the database will be rebuilt and signed. After a new Tripwire database is written, the newly authorized integrity violations will no longer show up as warnings.




Official Red Hat Linux Administrator's Guide
Official Red Hat Linux Administrators Guide
ISBN: 0764516957
EAN: 2147483647
Year: 2002
Pages: 278
Authors: Red Hat Inc

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net