1*19323693SBrad BishopPost-Installation Instructions 2*19323693SBrad Bishop1. Run the configuration script: /etc/tripwire/twinstall.sh to sign these files. This script walks you through the processes of setting passphrases and signing the Tripwire policy and configuration files. 3*19323693SBrad BishopNote: Once encoded and signed, the configuration file should not be renamed or moved. 4*19323693SBrad Bishop2. Initialize the Tripwire database file. (/usr/sbin/tripwire--init) 5*19323693SBrad Bishop3. Run the first integrity check. (/usr/sbin/tripwire--check) 6*19323693SBrad Bishop4. Edit the configuration file (twcfg.txt) with a text editor, if desired. 7*19323693SBrad Bishop5. Edit the policy file (twpol.txt) with a text editor, if desired. 8*19323693SBrad Bishop 9*19323693SBrad BishopNote: If you plan to modify the policy file, we recommend you do so before running the configuration script. If you modify the policy file after running the configuration script, you must re-run the configuration file before initializing the database file. 10*19323693SBrad Bishop 11*19323693SBrad BishopModifying the Policy File 12*19323693SBrad BishopYou can specify how Tripwire software checks your system in the Tripwire policy file (twpol.txt). A default policy file is included in the Tripwire software installation. We recommend you tailor this policy file to fit your particular system. Tailoring the policy file greatly increases Tripwire software's ability to ensure the integrity of your system. 13*19323693SBrad Bishop 14*19323693SBrad BishopLocate the default policy file at /etc/tripwire/twpol.txt. An example policy file (located at /usr/doc/tripwire-VER#-REL#/policyguide.txt) is included to help you learn the policy language. Read the sample policy file and the comments in the sample policy file to learn the policy language. 15*19323693SBrad Bishop 16*19323693SBrad BishopAfter you modify the policy file, follow the Post-Installation Instructions (run the configuration script). This script signs the modified policy file and renames it to tw.pol. This is the active policy file that runs as part of the Tripwire software. 17*19323693SBrad Bishop 18*19323693SBrad BishopSelecting Passphrases 19*19323693SBrad BishopTripwire files are signed or encrypted using site or local keys. These keys are protected by passphrases. When selecting passphrases, the following recommendations apply: 20*19323693SBrad BishopUse at least eight alphanumeric and symbolic characters for each passphrase. The maximum length of a passphrase is 1023 characters. Quotes should not be used as passphrase characters. 21*19323693SBrad Bishop 22*19323693SBrad BishopAssign a unique passphrase for the site key. The site key passphrase protects the site key, which is used to sign Tripwire software configuration and policy files. Assign a unique passphrase for the local key. The local key signs Tripwire database files. The local key may sign the Tripwire report files also. 23*19323693SBrad Bishop 24*19323693SBrad BishopStore the passphrases in a secure location. There is no way to remove encryption from a signed file if you forget your passphrase. If you forget the passphrases, the files are unusable. In that case you must reinitialize the baseline database. 25*19323693SBrad Bishop 26*19323693SBrad BishopInitializing the Database 27*19323693SBrad BishopIn Database Initialization mode, Tripwire software builds a database of filesystem objects based on the rules in the policy file. This database serves as the baseline for integrity checks. The syntax for Database Initialization mode is: 28*19323693SBrad Bishoptripwire --init 29*19323693SBrad Bishop 30*19323693SBrad BishopRunning an Integrity Check 31*19323693SBrad BishopThe Integrity Check mode compares the current file system objects with their properties recorded in the Tripwire database. Violations are printed to stdout. The report file is saved and can later be accessed by twprint. An email option enables you to send email. The syntax for Integrity Check mode is: 32*19323693SBrad Bishoptripwire --check 33*19323693SBrad Bishop 34*19323693SBrad BishopPrinting Reports - twprint Print Report Mode 35*19323693SBrad BishopThe twprint --print-report mode prints the contents of a Tripwire report. If you do not specify a report with the --twrfile or -r command-line argument, the default report file specified by the configuration file REPORTFILE variable is used. 36*19323693SBrad BishopExample: On a machine named LIGHTHOUSE, the command would be: 37*19323693SBrad Bishop./twprint -m r --twrfile LIGHTHOUSE-19990622-021212.twr 38*19323693SBrad Bishop 39*19323693SBrad BishopUpdating the Database after an Integrity Check 40*19323693SBrad BishopDatabase Update mode enables you to update the Tripwire database after an integrity check if you determine that the violations discovered are valid. This update process saves time by enabling you to update the database without having to re-initialize it. It also enables selective updating, which cannot be done through re-initialization. The syntax for Database Update mode is: 41*19323693SBrad Bishoptripwire --update 42*19323693SBrad Bishop 43*19323693SBrad BishopUpdating the Policy File 44*19323693SBrad BishopChange the way that Tripwire software scans the system by changing the rules in the policy file. You can then update the database without a complete re-initialization. This saves a significant amount of time and preserves security by keeping the policy file synchronized with the database it uses. The syntax for Policy Update mode is: 45*19323693SBrad Bishoptripwire --update-policy 46*19323693SBrad Bishop 47*19323693SBrad BishopTesting email functions 48*19323693SBrad BishopTest mode tests the software's email notification system, using the settings currently specified in the configuration file. The syntax for Email Test Reporting mode is: 49*19323693SBrad Bishoptripwire --test 50*19323693SBrad Bishop 51*19323693SBrad BishopTripwire Components 52*19323693SBrad BishopThe policy file begins as a text file containing comments, rules, directives, and variables. These dictate the way Tripwire software checks your system. Each rule in the policy file specifies a system object to be monitored. Rules also describe which changes to the object to report, and which to ignore. 53*19323693SBrad Bishop 54*19323693SBrad BishopSystem objects are the files and directories you wish to monitor. Each object is identified by an object name. A property refers to a single characteristic of an object that Tripwire software can monitor. Directives control conditional processing of sets of rules in a policy file. During installation, the text policy file is encrypted and renamed, and becomes the active policy file. 55*19323693SBrad Bishop 56*19323693SBrad BishopThe database file is an important component of Tripwire software. When first installed, Tripwire software uses the policy file rules to create the database file. The database file is a baseline "snapshot" of the system in a known secure state. Tripwire software compares this baseline against the current system to determine what changes have occurred. This is an integrity check. 57*19323693SBrad Bishop 58*19323693SBrad BishopWhen you perform an integrity check, Tripwire software produces report files. Report files summarize any changes that violated the policy file rules during the integrity check. You can view the report file in a variety of formats, at varying levels of detail. 59*19323693SBrad Bishop 60*19323693SBrad BishopThe Tripwire configuration file stores system-specific information, such as the location of Tripwire data files. Tripwire software generates some of the configuration file information during installation. The system administrator can change parameters in the configuration file at any time. The configuration file variables POLFILE, DBFILE, REPORTFILE, SITEKEYFILE, and LOCALKEYFILE specify where the policy file, database file, report files, and site and local key files reside. These variables must be defined or the configuration file is invalid. If any of these variables are undefined, an error occurs on execution of Tripwire software and the program exits. 61*19323693SBrad Bishop 62*19323693SBrad BishopTripwire Help 63*19323693SBrad BishopAll Tripwire commands support the help arguments. Example: To get help with Create Configuration File mode, type: ./twadmin --help --create-cfgfile 64*19323693SBrad Bishop 65*19323693SBrad Bishop-? Display usage and version information 66*19323693SBrad Bishop--help Display all command modes 67*19323693SBrad Bishop--help all Display help for all command modes 68*19323693SBrad Bishop--help [mode] Display help for current command mode 69*19323693SBrad Bishop--version Display version information 70