Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

466

|

Chapter 13: Simple Intrusion Detection Techniques

Use the --init directive only when creating a new database. If any of the files in your

tw.pol file are missing, you will be told as Tripwire starts up. We’ll see how to update

the database in the next section.

Running Tripwire Checks and Updates

Once you’ve got a database installed, you can run periodic checks against it. At its

simplest, the command to do so is the following:

# tripwire --check

This compares all protected files against the hash database and prints a report both

to the screen and to a binary file. The report can be viewed again with the command:

# twprint --print-report --report-level N --twrfile /path/file

where N is a number from 0 (a one-line summary) to 4 (a report providing full

details); /path/file is the full path and name of the latest report. By default, the report

will reside in /var/lib/tripwire/report, with a time-date stamp appended to its file-

name (e.g., /var/lib/tripwire/report/myron.polkatistas.org-20020311-221057.twr).

To have Tripwire automatically email the report to all recipients specified in the pol-

icy, you can run your check like this:

# tripwire --check --email-report

/usr/sbin/sendmail /usr/sbin/showmount

/usr/sbin/smrsh /usr/sbin/snmpd

/usr/sbin/snmptrapd /usr/sbin/squid

/usr/sbin/sshd /usr/sbin/stunnel ...