Tripwire log question

PktLoss · 08-20-2004, 09:23 PM

Hi, I was reading my tripwire log today, and there is a couple entries I don't understand:

Code:

-------------------------------------------------------------------------------
Rule Name: System boot changes (/var/run)
Severity Level: 100
-------------------------------------------------------------------------------

Added:
"/var/run/sudo/my_username/0:root"

-------------------------------------------------------------------------------
Rule Name: Critical configuration files (/etc/sysconfig)
Severity Level: 100
-------------------------------------------------------------------------------

Modified:
"/etc/sysconfig/hwconf"

-------------------------------------------------------------------------------
Rule Name: Security Control (/etc/security)
Severity Level: 100
-------------------------------------------------------------------------------

Modified:
"/etc/security/console.apps/ethereal"

I find the first one particularily troubling. Can anyone give me some info on what they mean?

unSpawn · 08-28-2004, 06:00 AM

Rule Name: System boot changes (/var/run)
/var/run should contain utmp, any PID files (daemon) processes set when they are started in a controlled fashion, sometimes sockets for processes, plus subdirs for some processes.

Severity Level: 100
(Arbitrary configurable?) alert scale. So what. Is 1000 really that worse than 100? :-]

Added:
"/var/run/sudo/my_username/0:root"
/var/run/sudo/ is Sudo's timestamp directory. If permissions change on that dir, that would be bad. The dir should be owner and group root, permissions 0700.