1.3. Modifying the Policy and Configuration
Problem
You want to change the set of files and directories that tripwire examines, or change tripwire’s default behavior.
Solution
Extract the policy and configuration to plaintext files: [Recipe 1.2]
# cd /etc/tripwire # twadmin --print-polfile > twpol.txt # twadmin --print-cfgfile > twcfg.txt
Modify the policy file twpol.txt and/or the configuration file twcfg.txt with any text editor. Then re-sign the modified files: [Recipe 1.1]
# twadmin --create-cfgfile --cfgfile /etc/tripwire/tw.cfg \
--site-keyfile site_key etc/tripwire/twcfg.txt
# twadmin --create-polfile --cfgfile /etc/tripwire/tw.cfg \
--site-keyfile site_key etc/tripwire/twpol.txtand reinitialize the database: [Recipe 1.1]
# tripwire --init # rm twcfg.txt twpol.txt
Discussion
This is much like setting up Tripwire from scratch [Recipe 1.1], except our existing, cryptographically-signed policy and configuration files are first converted to plaintext. [Recipe 1.2]
You’ll want to modify the policy if tripwire complains that a file does not exist:
### Error: File could not be opened.
Edit the policy file and remove or comment out the reference to this file if it does not exist on your system. Then re-sign the policy file.
You don’t need to follow this procedure if you’re simply updating the database after an integrity check [Recipe 1.11], only if you’ve modified the policy or configuration.
See Also
twadmin(8), tripwire(8).