LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 08-02-2004, 08:09 PM   #1
TruckStuff
Member
 
Registered: Apr 2002
Posts: 498

Rep: Reputation: 30
Tripwire + Logrotate Policy


I've been searching for an answer but havent eebn able to find a soluton to this issue.

I've got Tripwire installed on my server. Every weekend when logrotate rotates the sstem logs, Tripwire complains about policy violations. I tried adding a policy of:
Quote:
/var/log/messages -> $(SEC_LOG);
but it still complains. So what are others out there using for a Tripwire policy that doesn't complain about rotated logs?
 
Old 08-28-2004, 05:58 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,394
Blog Entries: 55

Rep: Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565
What exactly are those errors if I may ask?
 
Old 08-28-2004, 06:41 PM   #3
TruckStuff
Member
 
Registered: Apr 2002
Posts: 498

Original Poster
Rep: Reputation: 30
It complains that the various rotated logs have been changed, e.g. /var/log/messages, /var/log/messages.1. /var/log/messages.2, etc.

I understand why its complaining, I'm just hoping that there is a way to make it not complain so I don't have to update my tripwire DB every week.
 
Old 08-30-2004, 09:43 AM   #4
TruckStuff
Member
 
Registered: Apr 2002
Posts: 498

Original Poster
Rep: Reputation: 30
Here is an example for this AM:
Code:
-------------------------------------------------------------------------------
Rule Name: 'SystemLogs' (/var/log)
Severity Level: 66
-------------------------------------------------------------------------------

Modified:
"/var/log/boot.log"
"/var/log/boot.log.1"
"/var/log/boot.log.2"
"/var/log/boot.log.3"
"/var/log/boot.log.4"
"/var/log/cron"
"/var/log/cron.1"
"/var/log/cron.2"
"/var/log/cron.3"
"/var/log/cron.4"
"/var/log/firewall.log"
"/var/log/firewall.log.1"
"/var/log/firewall.log.2"
"/var/log/firewall.log.3"
"/var/log/firewall.log.4"
"/var/log/maillog"
"/var/log/maillog.1"
"/var/log/maillog.2"
"/var/log/maillog.3"
"/var/log/maillog.4"
"/var/log/messages.1"
"/var/log/messages.2"
"/var/log/messages.3"
"/var/log/messages.4"
"/var/log/rpmpkgs"
"/var/log/rpmpkgs.1"
"/var/log/rpmpkgs.2"
"/var/log/rpmpkgs.3"
"/var/log/rpmpkgs.4"
"/var/log/secure"
"/var/log/secure.1"
"/var/log/secure.2"
"/var/log/secure.3"
"/var/log/secure.4"
"/var/log/spooler"
"/var/log/spooler.1"
"/var/log/spooler.2"
"/var/log/spooler.3"
"/var/log/spooler.4"
"/var/log/xferlog"
"/var/log/xferlog.1"
"/var/log/xferlog.2"
"/var/log/xferlog.3"
"/var/log/xferlog.4"
 
Old 08-31-2004, 08:31 PM   #5
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,394
Blog Entries: 55

Rep: Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565
I'd try "/var/log -> $(SEC_CONFIG);" on the DIR not specific files.
 
Old 09-02-2004, 09:56 AM   #6
TruckStuff
Member
 
Registered: Apr 2002
Posts: 498

Original Poster
Rep: Reputation: 30
Quote:
Originally posted by unSpawn
I'd try "/var/log -> $(SEC_CONFIG);" on the DIR not specific files.
Unfortunately, that's what I have now:
Code:
# cat twpol.txt | grep /var/log
     /var/log                          -> $(SEC_CONFIG) ;
 
Old 09-08-2005, 04:00 PM   #7
mstruzak
LQ Newbie
 
Registered: Sep 2005
Posts: 2

Rep: Reputation: 0
In my setup the error is caused by the Inode check every time logs are rotated; try this:
Code:
/var/log                          -> $(SEC_CONFIG) -i ;
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How to set the password policy and lockout policy bin_shell Linux - Security 4 03-24-2010 04:30 PM
Samba System Policy, Default User Policy scooter549 Linux - General 2 02-24-2009 03:23 AM
Tripwire policy Q TruckStuff Linux - Security 1 07-03-2005 07:50 AM
Tripwire policy update brain_bucket Linux - Security 2 09-03-2003 09:35 AM
Need Tripwire Policy Advice JimKyle Linux - Security 4 03-03-2002 06:03 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 09:30 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration