lazy tripwire user

squirrel · n00b Joined: 26 Jul 2002 Posts: 20

I recently emerged tripwire for use on my internet facing server at home. Using the sample policy file, I came up with 298 File system errors (cases of the policy specifying files that don't exist on my sytem, or exist in a different place)

Now of course, being lazy, I really don't want to verify / change 298 things in my twpol.txt. Soo.... I was wondering if anyone would be willing to post a twpol.txt that had been tailored to a base Gentoo system, to which I could add things later.

Am I too lazy? Should I suck it up and start going through my twpol.txt ?

jesterspet · Posted: Fri Jan 09, 2004 2:10 am Post subject:

I just installed Tripwire as well, however, I used the output & sed to edit my policy to remove the file entrys that don't exist.

However, I have not updated it to include the packages I have installed.

I would suggest you:

copy your output into a file.
grep the file for Filename: and output that to a file. e.g.$grep 'Filename:' $FILENAME >> results
run $sed -e 's/Filename: //' $FILENAME to get a listing of the paths & files that the current policy could not find.

Since the sample file is based on RedHat, it will look for files in different places, than Gentoo stores them.

Correct any paths to files that do exist on your computer.
Remove or comment out the entries for files that do not exist on your computer, in the /etc/tripwire/twpol.txt file.
Double check your work in the previous two steps.
Run $tripwire -m p -Z low /etc/tripwire/twpol.txt to update your policy.
Run $tripwire --check to ensure that your changes have had the desired effect.

You should now have a base policy for your Gentoo instalation.

Now the really hard part comes. Look at the policy file you just edited, add the missing files that do exist on your system to the policy with the appropiate codes. This is the part I am currently performing.
_________________
(X) Yes! I am a brain damaged lemur on crack, and would like to buy your software package for $499.95

squirrel · n00b Joined: 26 Jul 2002 Posts: 20

Thanks, using sed is a much better way of resolving this than my method (manual edit). I have much to learn

mbjr · Posted: Mon Mar 22, 2004 9:41 pm Post subject:

Hi,

Come on guys, would you make the results available for the public? :-)

I'm another lazy one

I'd suggest to send the results to tripwire.org as well to make them able to share it with whoever. Please ;P That's what opensource is about :-)

_________________
mb

squirrel · n00b Joined: 26 Jul 2002 Posts: 20

I did post an edited twpol.txt on the bug report I did, but neglected to post in forum. Oops.

Bug report:

https://bugs.gentoo.org/show_bug.cgi?id=34662

Here's my edited file.

mbjr · Posted: Tue Mar 23, 2004 9:10 pm Post subject:

Thankyou

Well, I'm not that lazy though, so I'm spending time with writing a shell script that generates your twpol from the system it runs on.

I'll post it here when I'll have time to finish it :-)

_________________
mb

puke · Tux's lil' helper Joined: 05 Oct 2002 Posts: 128

mbjr · Posted: Sat Apr 03, 2004 11:10 pm Post subject:

it is. not done yet, didn't have time to finish it up

I'm sorry. I'll post it as soon as it gets done

_________________
mb

mbjr · Posted: Fri Aug 27, 2004 7:10 am Post subject:

Guys,

This is a much biger project than I've ever thought. I think I better do a feature req to the tripwire team, since there're some issues can't be determined and completed by a "small shell script".

This means I'll not be able to do the "confmaker" for you

I'm sorry.
_________________
mb

nielchiano · Veteran Joined: 11 Nov 2003 Posts: 1287 Location: 50N 3E

I just imported your policy, but have this strange result:
Tripwire complains about /usr/sbin/siggen not existing. I just remerged the tripwire-ebuild and, yes, there is no siggen file merged. IS THIS NORMAL? or is someone already on my machine (unlikely, but possible)

strange thing is: the siggen.8 man page IS installed, but no binary

PS: I emerged app-admin/tripwire-2.3.1.2-r1

eldo21 · n00b Joined: 20 Oct 2004 Posts: 6

I too am missing the siggen app... Anyone know why? Do I need to install it seperate from tripwire?

Thanks Chad

andrewchou · n00b Joined: 12 Dec 2004 Posts: 1

http://medien.informatik.uni-ulm.de/~stefan/linux/siggen.html

anoland · Tux's lil' helper Joined: 27 May 2003 Posts: 86

I found a script at Red Hat forums which comments out the missing files. I just exported the mail message from pine to tw-list.txt and ran this script which I modified to put the comments in a sensible place.

Skyr · n00b Joined: 16 Mar 2005 Posts: 8

cboldt · Veteran Joined: 24 Aug 2005 Posts: 1046