topic Re: having problem updating db on tripwire... in Operating System - Linux

having problem updating db on tripwire...

K.C. Chan — Mon, 21 Mar 2005 12:32:49 GMT

all,
I made changes to /etc/passwd and do not want .sh_history-1, .sh-history-2, and so on be monitored by tripwire. So what I did is made changes to policy file and update it via "tripwire -m p /path/policyfile", however, I am getting this error:

======== Policy Update: Processing section Unix File System.
======== Step 1: Gathering information for the new policy.
### Error: Policy Update Changed Object.
### An object has been changed since the database was last updated.
### Object name: Conflicting properties for object /etc/sysconfig/hwconf
### > Modify Time
### Error: Policy Update Changed Object.
### An object has been changed since the database was last updated.
### Object name: Conflicting properties for object /etc/passwd
### > Inode Number
### Error: Policy Update Changed Object.
### An object has been changed since the database was last updated.
### Object name: Conflicting properties for object /root
### > Modify Time
### > Change Time
======== Step 2: Updating the database with new objects.
======== Step 3: Pruning unneeded objects from the database.
Policy update failed; policy and database files were not altered.

Does any one have any idea? Thanks.

Re: having problem updating db on tripwire...

Steven E. Protter — Mon, 21 Mar 2005 14:57:05 GMT

Part of the setup of tripwire involves creating a new database, which is a snapshot of the current system.

Something has changed and you may need to do a new tripwire database.

Might first want to run some reports and make sure you have not been hacked or modified without authorization.

SEP

Re: having problem updating db on tripwire...

K.C. Chan — Mon, 21 Mar 2005 15:13:37 GMT

No,
it's not hacked. I added a user. so the password file changes. So to reconcile the changes I have to create a new base db file? Couldn't I just run an update command instead? It seems to be a waist of resource to generate a new db every time there's a valid change ocurring in the system.