Table of Contents
Advertisement
Section 11.10:Updating the Database after an Integrity Check
-rwxr-xr-x
To see information about a particular file that Tripwire is tracking, such as /etc/hosts, type a
different twprint command:
/usr/sbin/twprint -m d --print-dbfile /etc/hosts
The result will look similar to this:
Object name:
Property:
-------------
Object Type
Device Number
Inode Number
Mode
Num Links
UID
GID
See the twprint man page for other options.
11.10 Updating the Database after an Integrity Check
If you run an integrity check and Tripwire finds violations, you will first need to determine whether
the violations discovered are actual security breaches or the product of authorized modifications. If
you recently installed an application or edited critical system files, Tripwire will (correctly) report
integrity check violations. In this case, you should update your Tripwire database so those changes
are no longer reported as violations. However, if unauthorized changes are made to system files that
generate integrity check violations, then you should restore the original file from a backup or reinstall
the program.
To update your Tripwire database to accept the violations found in a report, you must specify the report
you wish to use to update the database. When issuing the command to integrate those valid violations
into your database, be sure to use the most recent report. Type the following command (all on one
line), where name is the name of the report to be used:
/usr/sbin/tripwire --update --twrfile
/var/lib/tripwire/report/ <name> .twr
Tripwire will show you the particular report using the default text editor (specified in the Tripwire
configuration file on the
updated in the Tripwire database. It is important that you only allow authorized integrity violations to
be changed in the database.
root (0)
405576
/etc/hosts
Value:
-----------
Regular File
773
216991
-rw-r--r--
1
root (0)
root (0)
line). This is your chance to deselect files that you do not wish to be
EDITOR
Thu Dec
7 22:35:05 2000
177
Advertisement
Table of Contents
