tripwire policy update fails

dsids · 08-04-2006, 08:12 AM

Hi,
I have installed tripwire-2.3.1.2-8mdk on my FC4 because I cudnt find an rpm for fedora..

Well, my problem is that Im not able to update the tripwire policy file.. I have tripwire already running on my system..I follewd the instructions in the guide but have not been able to update....

I have added the "emailto =" directive so that the reports can be mailed to me

I do
#tripwire -m p /etc/tripwire/twpol.txt
.....
Object name: /var/lib/tripwire/devp47.twd
### Error: Policy Update Changed Object.
### An object has been changed since the database was last updated.
### Object name: Conflicting properties for object /etc/tripwire/tw.pol
### > Modify Time
### > CRC32
### > MD5
### Error: Policy Update Changed Object.
### An object has been changed since the database was last updated.
### Object name: Conflicting properties for object /etc/tripwire/tw.cfg
### > Modify Time
### > CRC32
### > MD5
### Error: Policy Update Changed Object.
### An object has been changed since the database was last updated.
### Object name: Conflicting properties for object /root
### > Modify Time
### > Change Time
### Error: Policy Update Changed Object.
### An object has been changed since the database was last updated.
### Object name: Conflicting properties for object /root/.keychain
### > Modify Time
### > Change Time
======== Step 2: Updating the database with new objects.
======== Step 3: Pruning unneeded objects from the database.
Policy update failed; policy and database files were not altered.

Any idea whats going wrong..

Appreciate your help

Thanks
Danish

gilead · 08-04-2006, 04:52 PM

If I have to modify my policy I do the following:

Code:

Take the box off the network so it's isolated;
Run tripwire --check -I and make sure everything is OK;
Run tripwire --update-policy --secure-mode low --verbose --cfgfile tw.cfg --site-keyfile site.key twpol.txt

zerg4141 · 08-07-2006, 02:06 PM

not that this is helping answer your question, but there is another program called Samhain out there (GPL) that seems to be much more active a project than tripwire. It provides the same type of service, but I really like the way they do it, and has some nice features for the paranoid (eg. "stealth mode", uses the tiger192 digest, hides its hash database stenographically in another file, etc...)

just an fyi

--Zerg4141

dsids · 08-08-2006, 08:11 AM

Thank you gilead..seems like the command that you specified worked because I did not receieve any errors after running the command..But unfortunately there seems to be some problem on the network because mail are not being delivered on the network...Ill get back if required..

zerg4141..
I havent really checked out Samhain, but it seems interesting..
Ill get back if required.

Thanks
Danish

gilead · 08-08-2006, 02:57 PM

If tripwire is trying to send the mail via sendmail (for example) there should be an entry in /var/log/maillog - if it's not there then the change probably didn't work. If there's an entry in the log, can you post it here? Hopefully it's just a config issue.