Changes

Tripwire

2,194 bytes added, 17:04, 2 July 2015
The following lines were added (+) and removed (-):
For Debian/Ubuntu (as root or sudo) apt-get update apt-get install tripwireTripwire uses two different keys for authentication and encryption of files.  The site key is used to protect files that could be used across several systems.  This includes the policy and configuration files.  You are being prompted for this passphrase either because no site key exists at this time or because you have requested the rebuilding of the policy or configuration files.  Remember this passphrase; it is not stored anywhere!  Enter site-key passphraseTripwire uses two different keys for authentication and encryption of files.  The local key is used to protect filesspecific to the local machine, such as the Tripwire database.  The local key may also be used for signing integrity checkreports.The Tripwire binaries are located in /usr/sbin and the database is located in /var/lib/tripwire. It is strongly advised thatthese locations be stored on write-protected media (e.g. mounted RO floppy). See /usr/share/doc/tripwire/README.Debian fordetails. twadmin --create-polfile /etc/tripwire/twpol.txt Please enter your site passphrase: Wrote policy file: /etc/tripwire/tw.polThe basic way to initialize the database is by running: tripwire --init vi /etc/tripwire/twpol.txtDo a search for each of the files that were returned in the test_results file. Comment out all of the lines that you find that match.In the "Boot Scripts" section, you should comment out the /etc/rc.boot line, since this isn't present in an Ubuntu system: twadmin -m P /etc/tripwire/twpol.txt tripwire --initcheck to see what the tripwire report looks like and if there are truly no warnings: tripwire --check rm /etc/tripwire/test_results apt-get install mailutilstest of our system's ability to mail out a tripwire report. tripwire --check | mail -s "Tripwire report for `uname -n`" tripwire@foo.comReceive a report shortly in your email with details about the new mail software you just installed.Approve the software changes we made by doing an interactive check to update the database. tripwire --check --interactiveThis generates a report and opens it in pico editor. crontab -e
Bureaucrat, administrator
16,192
edits