tripwire policy update fails
Hi,
I have installed tripwire-2.3.1.2-8mdk on my FC4 because I cudnt find an rpm for fedora.. Well, my problem is that Im not able to update the tripwire policy file.. I have tripwire already running on my system..I follewd the instructions in the guide but have not been able to update.... I have added the "emailto =" directive so that the reports can be mailed to me I do #tripwire -m p /etc/tripwire/twpol.txt ..... Object name: /var/lib/tripwire/devp47.twd ### Error: Policy Update Changed Object. ### An object has been changed since the database was last updated. ### Object name: Conflicting properties for object /etc/tripwire/tw.pol ### > Modify Time ### > CRC32 ### > MD5 ### Error: Policy Update Changed Object. ### An object has been changed since the database was last updated. ### Object name: Conflicting properties for object /etc/tripwire/tw.cfg ### > Modify Time ### > CRC32 ### > MD5 ### Error: Policy Update Changed Object. ### An object has been changed since the database was last updated. ### Object name: Conflicting properties for object /root ### > Modify Time ### > Change Time ### Error: Policy Update Changed Object. ### An object has been changed since the database was last updated. ### Object name: Conflicting properties for object /root/.keychain ### > Modify Time ### > Change Time ======== Step 2: Updating the database with new objects. ======== Step 3: Pruning unneeded objects from the database. Policy update failed; policy and database files were not altered. Any idea whats going wrong.. Appreciate your help Thanks Danish |
If I have to modify my policy I do the following:
Code:
Take the box off the network so it's isolated; |
tripwire alternative
not that this is helping answer your question, but there is another program called Samhain out there (GPL) that seems to be much more active a project than tripwire. It provides the same type of service, but I really like the way they do it, and has some nice features for the paranoid (eg. "stealth mode", uses the tiger192 digest, hides its hash database stenographically in another file, etc...)
just an fyi --Zerg4141 |
Thank you gilead..seems like the command that you specified worked because I did not receieve any errors after running the command..But unfortunately there seems to be some problem on the network because mail are not being delivered on the network...Ill get back if required..
zerg4141.. I havent really checked out Samhain, but it seems interesting.. Ill get back if required. Thanks Danish |
If tripwire is trying to send the mail via sendmail (for example) there should be an entry in /var/log/maillog - if it's not there then the change probably didn't work. If there's an entry in the log, can you post it here? Hopefully it's just a config issue.
|
All times are GMT -5. The time now is 04:38 PM. |