Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Other Integrity Checkers

|

469

is equivalent to these two commands:

# tripwire --check

# tripwire --update --twrfile /path/to/reportname.twr

but with the added advantage of saving you the trouble of looking up the report’s

filename (which, since it includes a timestamp, isn’t easily guessed). Being interac-

tive, of course, this method can’t be used for automated checks (e.g., cron jobs).

(Updating the Tripwire database should never be done unattended, even though it’s

possible. You’ll never hear how from me, though; it’s that dumb of an idea.)

Changing Tripwire’s Policy

I needn’t bother repeating my mantra “some false positives are okay, no false nega-

tives are!” But after your first Tripwire check or two, you’ll probably want to adjust

your Tripwire policy to exclude some things, include others, and watch still others

less closely.

Earlier, I mentioned that the twadmin command should be used to install only the

initial policy, not updated policies. If you need to change your Tripwire policy after

the database has been initialized (i.e., after you’ve run

tripwire --init), use the

commands in Example 13-8 to dump, edit, and install it again.

When you use the -

-update-policy directive, Tripwire will parse the specified policy

text file, generate a new database, and compare all records that ...