Quote:
Originally Posted by noir911
I'm getting email every day on tripwire output and would like to stop it. I know I have to run tripwire again to make the new changes take effect and that will stop the email from coming. I'm not sure how to do that.
|
Well, it depends on what exactly happened. First of all, are you positive that the changes being reported aren't the result of a security breach? Are you able to account for the exact reasons why the changes have been made? Once you are certain that the changes are benign, you need to determine whether your situation merits that the database be updated (as opposed to only the policy). Any Tripwire tutorial should have instructions for dealing with either case. An example of such a tutorial is
this one.
