topic Re: help with tripwire ... in Operating System - Linux

help with tripwire ...

K.C. Chan — Sun, 15 May 2005 12:40:36 GMT

all,
I am getting error when trying to update the policy file:
# tripwire -m p twpol.txt
Parsing policy file: /etc/tripwire/twpol.txt
Please enter your local passphrase:
Please enter your site passphrase:
======== Policy Update: Processing section Unix File System.
======== Step 1: Gathering information for the new policy.

### Error: Policy Update Changed Object.
### An object has been changed since the database was last updated.
### Object name: Conflicting properties for object /root
### > Modify Time
### > Change Time
======== Step 2: Updating the database with new objects.
======== Step 3: Pruning unneeded objects from the database.
Policy update failed; policy and database files were not altered.

Any idea?

Re: help with tripwire ...

Stuart Browne — Sun, 15 May 2005 23:03:59 GMT

You'll need to make sure you accept all current system alterations prior to updating the policy (as against re-creating a policy).

Basically, just update the current database (after reviwing the current tripwire report in /var/lib/tripwire/report/...), 'tripwire -m u --accept-all' if memory serves, then try updating the policy.

Re: help with tripwire ...

Steven E. Protter — Sun, 15 May 2005 23:06:18 GMT

Wow, not even an error code.

echo $?

What response code did the program give?

Follow that evidence.

Check that appropriate permissions are set on the file being updated.

SEP

Re: help with tripwire ...

Gopi Sekar — Mon, 16 May 2005 00:43:54 GMT

Looks to be a particular file got modified (in terms of permissions, size, timestamp etc) which is being watched by tripwire.

either you accept all the changes and re run the update or check which file has modified and whats the reason.

Gopi