LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 08-04-2006, 07:12 AM   #1
dsids
Member
 
Registered: Mar 2006
Distribution: FC4
Posts: 184

Rep: Reputation: 31
tripwire policy update fails


Hi,
I have installed tripwire-2.3.1.2-8mdk on my FC4 because I cudnt find an rpm for fedora..

Well, my problem is that Im not able to update the tripwire policy file.. I have tripwire already running on my system..I follewd the instructions in the guide but have not been able to update....

I have added the "emailto =" directive so that the reports can be mailed to me

I do
#tripwire -m p /etc/tripwire/twpol.txt
.....
Object name: /var/lib/tripwire/devp47.twd
### Error: Policy Update Changed Object.
### An object has been changed since the database was last updated.
### Object name: Conflicting properties for object /etc/tripwire/tw.pol
### > Modify Time
### > CRC32
### > MD5
### Error: Policy Update Changed Object.
### An object has been changed since the database was last updated.
### Object name: Conflicting properties for object /etc/tripwire/tw.cfg
### > Modify Time
### > CRC32
### > MD5
### Error: Policy Update Changed Object.
### An object has been changed since the database was last updated.
### Object name: Conflicting properties for object /root
### > Modify Time
### > Change Time
### Error: Policy Update Changed Object.
### An object has been changed since the database was last updated.
### Object name: Conflicting properties for object /root/.keychain
### > Modify Time
### > Change Time
======== Step 2: Updating the database with new objects.
======== Step 3: Pruning unneeded objects from the database.
Policy update failed; policy and database files were not altered.

Any idea whats going wrong..

Appreciate your help

Thanks
Danish
 
Old 08-04-2006, 03:52 PM   #2
gilead
Senior Member
 
Registered: Dec 2005
Location: Brisbane, Australia
Distribution: Slackware64 14.0
Posts: 4,138

Rep: Reputation: 168Reputation: 168
If I have to modify my policy I do the following:
Code:
Take the box off the network so it's isolated;
Run tripwire --check -I and make sure everything is OK;
Run tripwire --update-policy --secure-mode low --verbose --cfgfile tw.cfg --site-keyfile site.key twpol.txt
 
Old 08-07-2006, 01:06 PM   #3
zerg4141
LQ Newbie
 
Registered: Jul 2005
Distribution: Debian
Posts: 27

Rep: Reputation: 15
tripwire alternative

not that this is helping answer your question, but there is another program called Samhain out there (GPL) that seems to be much more active a project than tripwire. It provides the same type of service, but I really like the way they do it, and has some nice features for the paranoid (eg. "stealth mode", uses the tiger192 digest, hides its hash database stenographically in another file, etc...)

just an fyi

--Zerg4141
 
Old 08-08-2006, 07:11 AM   #4
dsids
Member
 
Registered: Mar 2006
Distribution: FC4
Posts: 184

Original Poster
Rep: Reputation: 31
Thank you gilead..seems like the command that you specified worked because I did not receieve any errors after running the command..But unfortunately there seems to be some problem on the network because mail are not being delivered on the network...Ill get back if required..

zerg4141..
I havent really checked out Samhain, but it seems interesting..
Ill get back if required.

Thanks
Danish
 
Old 08-08-2006, 01:57 PM   #5
gilead
Senior Member
 
Registered: Dec 2005
Location: Brisbane, Australia
Distribution: Slackware64 14.0
Posts: 4,138

Rep: Reputation: 168Reputation: 168
If tripwire is trying to send the mail via sendmail (for example) there should be an entry in /var/log/maillog - if it's not there then the change probably didn't work. If there's an entry in the log, can you post it here? Hopefully it's just a config issue.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
editing of configuration and policy file and implementing tripwire anil2003 Linux - Security 1 04-24-2006 02:52 PM
Tripwire + Logrotate Policy TruckStuff Linux - Security 6 09-08-2005 03:00 PM
Tripwire policy Q TruckStuff Linux - Security 1 07-03-2005 06:50 AM
Tripwire policy update brain_bucket Linux - Security 2 09-03-2003 08:35 AM
Need Tripwire Policy Advice JimKyle Linux - Security 4 03-03-2002 05:03 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 12:05 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration