Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

462

|

Chapter 13: Simple Intrusion Detection Techniques

Such a statement is called a stop point: it defines an exception to a rule. In this case,

the stop point tells Tripwire to ignore changes to the file /home/mick/www/guestbook.

html. Attributes do not apply to (nor may they be assigned to) stop points.

Examples 13-2 through 13-4 constitute a semantically complete policy file, but not a

useful one—it doesn’t check any system binaries or configuration files at all. Real

policies are much longer. Here’s the policy in one listing (Example 13-5).

You may have noticed that this entire file contains only one explicit reference to a

property mask: the variable declaration in which

DIR_SEMISTATIC is set to +tpug.

What does that mean?

Property masks

A property mask is a series of file or directory properties that should be checked or

ignored for a given object. Properties following a

+ are checked; those following a -

are ignored. The properties are abbreviated as shown in Table 13-1.

*

Example 13-5. A sample policy file

WEBROOT=/home/mick/www;

CGIBINS=/home/mick/www/cgi-bin;

TWPOL="/etc/tripwire";

TWDB="/var/lib/tripwire";

BINS = $(ReadOnly) ; # Binaries that should not change

DIR_SEMISTATIC = +tpug ; # Directories that shouldn't change perms/ownership

SIG_MED = 66 ; # Important but not system-critical ...