topic Re: tripwire update policy .... in Operating System - Linux

tripwire update policy ....

K.C. Chan — Mon, 31 Oct 2005 14:36:53 GMT

All,
is there a way to update the policy without having to regenerate a new tripwire database. I tried updating the policy, then ran a check. It seems that it reset everyting; the files it was reporting inconsistency is nolonger inconsistence. Any idea?

Re: tripwire update policy ....

Steven E. Protter — Mon, 31 Oct 2005 15:26:47 GMT

What command did you use?

There is an update command set that does not reset the whole database.

SEP

Re: tripwire update policy ....

Ivan Ferreira — Mon, 31 Oct 2005 16:42:43 GMT

The command should be like:

/usr/sbin/tripwire --update --twrfile /var/lib/tripwire/report/.twr

Re: tripwire update policy ....

K.C. Chan — Mon, 31 Oct 2005 19:29:14 GMT

tripwire -m p -Z low twpol.txt, I used this to change the the policy file.

Re: tripwire update policy ....

Ivan Ferreira — Mon, 31 Oct 2005 20:16:25 GMT

If you want to update the database, run the command that I methioned above, if you want to modify the policy file, run:

twadmin --print-polfile > /etc/tripwire/twpol.txt

Modify the file.

/usr/sbin/twadmin --create-polfile -S site.key /etc/tripwire/twpol.txt

/usr/sbin/tripwire --init

Re: tripwire update policy ....

K.C. Chan — Tue, 01 Nov 2005 23:33:52 GMT

twadmin command seems straightforward, but for this command "tripwire --init" which is the same as "tripwire -m i" is questionable as far as updating the database. I think this option "-m i" initialize the database instead of updating it. After reading the man page, I believe the option to update the database should be "tripwire -m u". Any thoughts on this? Thanks.

Re: tripwire update policy ....

Ivan Ferreira — Wed, 02 Nov 2005 06:38:43 GMT

I think that -m u is the same as /usr/sbin/tripwire --update --twrfile /var/lib/tripwire/report/.twr

It updates the database so file modifications are recorded, but you cannot for example, remove or add a file to the database.

Re: tripwire update policy ....

K.C. Chan — Wed, 02 Nov 2005 10:38:28 GMT

so tripwire --init will add/remote files to the database? Does it also initialize files that is allready there? If so, then will it reset the files that has changed since the the last run. If it does, then this is not the option I am looking for. I am looking for an option which update add/remove files in the database without resetting the files that has changed in the database. Thanks.

Re: tripwire update policy ....

Ivan Ferreira — Wed, 02 Nov 2005 13:16:01 GMT

I did not understand but the --init will do a new snapshot.

What do you mean with:

Does it also initialize files that is allready there?

The new snapshot will consider all "current" files as the good ones.

These are the only ways that I know.

Cheers.