1

I have created the policy file in Tripwire and also I have created the rules as well mentioned below:

/opt/jboss/server/gis/conf -> $(SEC_CONFIG) +aipm +c+g+a+i+s+t+u+l+M;

/usr/local/gtech/eseries/ -> $(SEC_CONFIG) +a+c+g+i+s+t+u+l+M ;

After running the integrity check the output should be a(Access timestamp),c (Inode timestamp (create/modify),g (File owner's group ID),i (Inode number),s (File size),t (time stamp),u (File owner's user ID),l(File is increasing in size (a "growing file"),M (MD5 hash value).

I am getting the output as below:

[root@xxsi1242 tripwire]# tripwire --check
 Parsing policy file: /etc/tripwire/tw.pol
 *** Processing Unix File System ***
 Performing integrity check...
 Wrote report file: /var/lib/tripwire/report/xxsi1242.gtk.gtech.com-20131106-053812.twr


Open Source Tripwire(R) 2.4.1 Integrity Check Report

Report generated by: root
 Report created on: Wed 06 Nov 2013 05:38:12 AM EST
 Database last updated on: Wed 06 Nov 2013 05:31:17 AM EST

===============================================================================
 Report Summary:
 ===============================================================================

Host name: xxsi1242.gtk.gtech.com
 Host IP address: 156.24.65.171
 Host ID: None
 Policy file used: /etc/tripwire/tw.pol
 Configuration file used: /etc/tripwire/tw.cfg
 Database file used: /var/lib/tripwire/xxsi1242.gtk.gtech.com.twd
 Command line used: tripwire --check

===============================================================================
 Rule Summary:
 ===============================================================================

-------------------------------------------------------------------------------
 Section: Unix File System
 -------------------------------------------------------------------------------

Rule Name Severity Level Added Removed Modified
 --------- -------------- ----- ------- --------
 Invariant Directories 66 0 0 0
 Temporary directories 33 0 0 0
 * Tripwire Data Files 100 0 0 1
 Tech Stack 100 0 0 0
 User binaries 66 0 0 0
 Tripwire Binaries 100 0 0 0
 * CLPS bins 100 0 0 2
 CLPS Configuration files 100 0 0 0
 ESCommon 100 0 0 0
 Shell Binaries 100 0 0 0
 OS executables and libraries 100 0 0 0
 Security Control 100 0 0 0
 ESCommon Configuration 100 0 0 0
 (/etc/gtech/escommon)

Total objects scanned: 12358
 Total violations found: 3

===============================================================================
 Object Summary:
 ===============================================================================

-------------------------------------------------------------------------------
 # Section: Unix File System
 -------------------------------------------------------------------------------

-------------------------------------------------------------------------------
 Rule Name: Tripwire Data Files (/etc/tripwire/tw.pol)
 Severity Level: 100
 -------------------------------------------------------------------------------

Modified:
 "/etc/tripwire/tw.pol"

-------------------------------------------------------------------------------
 Rule Name: CLPS bins (/opt/jboss/server)
 Severity Level: 100
 -------------------------------------------------------------------------------

Modified:
 "/opt/jboss/server/esapps1/data/hypersonic/localDB.lck"
 "/opt/jboss/server/gis/data/hypersonic/localDB.lck"

===============================================================================
 Error Report:
 ===============================================================================

No Errors

-------------------------------------------------------------------------------
 *** End of report ***

Note:

In the output I only am getting the files which are modified. I need the detail output for this. But unfortunately I am not getting what I expected. Please help me to proced further.

0

Does adding '-v' to the command line, for verbose mode, output the info you want? Does the tripwire report file (*.twr) have the info you want?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.