Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guide d'installation télécharger pdf (Page 155)

Chapter 12. Installing and Conﬁguring Tripwire 155

------------- -----------

Object Type Regular File

Device Number 773

Inode Number 216991

Mode -rw-r--r--

Num Links 1

UID root (0)

GID root (0)

See the twprint man page for other options.

12.10. Updating the Database after an Integrity Check

If you run an integrity check and Tripwire ﬁnds violations, you will ﬁrst need to determine whether

the violations discovered are actual security breaches or the product of authorized modiﬁcations. If

you recently installed an application or edited critical system ﬁles, Tripwire will (correctly) report

integrity check violations. In this case, you should update your Tripwire database so those changes

are no longer reported as violations. However, if unauthorized changes are made to system ﬁles that

generate integrity check violations, then you should restore the original ﬁle from a backup or reinstall

the program.

To update your Tripwire database to accept the violations found in a report, you must specify the

report you wish to use to update the database. When issuing the command to integrate those valid

violations into your database, be sure to use the most recent report. Type the following command (all

on one line), where name is the name of the report to be used:

/usr/sbin/tripwire --update --twrfile

/var/lib/tripwire/report/

name .twr

Tripwire will show you the particular report using the default text editor (speciﬁed in the Tripwire

conﬁguration ﬁle on the EDITOR line). This is your chance to deselect ﬁles that you do not wish to

be updated in the Tripwire database. It is important that you only allow authorized integrity violations

to be changed in the database.

All proposed updates to the Tripwire database start with a [x] before the ﬁle name. If you want to

speciﬁcally exclude a valid violation from being added to the Tripwire database, remove the x from

the box. To accept any ﬁles with an x beside them as changes, write the ﬁle in the editor and quit the

text editor. This signals to Tripwire to alter its database and not report these ﬁles as violations.

For example, the default text editor for Tripwire is vi. To write the ﬁle with vi and make the changes

to the Tripwire database when updating with a speciﬁc report, type :wq in vi’s command mode and

press [Enter]. You will be asked to enter your local passphrase. Then, a new database ﬁle will be

written to include the valid violations.

After a new Tripwire database is written, the newly authorized integrity violations will no longer show

up as warnings when the next integrity check is run.

12.11. Updating the Policy File

If you want to actually change the ﬁles Tripwire records in its database or modify the severity in which

violations are reported, you need to edit your Tripwire policy ﬁle.

First, make whatever changes are necessary to the sample policy ﬁle (/etc/tripwire/twpol.txt).

A common change to this policy ﬁle is to comment out any ﬁles that do not exist on your system so that

they will not generate a file not found error in your Tripwire reports. For example, if your system

1 2 ... 150 151 152 153 154 155 156 157 158 159 160 ... 281 282

Commentaires sur ces manuels

Pas de commentaire

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guide d'installation Page 155

Commentaires sur ces manuels

Produits connexes et manuels pour Logiciel de gestion du système Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE