Tripwire help Required
- by ramaperumal
I have created the policy file in Tripwire and also I have created the rules as well mentioned below:
/opt/jboss/server/gis/conf -> $(SEC_CONFIG) +aipm +c+g+a+i+s+t+u+l+M;
/usr/local/gtech/eseries/ -> $(SEC_CONFIG) +a+c+g+i+s+t+u+l+M ;
After running the integrity check the output should be a(Access timestamp),c (Inode timestamp (create/modify),g (File owner's group ID),i (Inode number),s (File size),t (time stamp),u (File owner's user ID),l(File is increasing in size (a "growing file"),M (MD5 hash value).
I am getting the output as below:
[root@xxsi1242 tripwire]# tripwire --check
Parsing policy file: /etc/tripwire/tw.pol
*** Processing Unix File System ***
Performing integrity check...
Wrote report file: /var/lib/tripwire/report/xxsi1242.gtk.gtech.com-20131106-053812.twr
Open Source Tripwire(R) 2.4.1 Integrity Check Report
Report generated by: root
Report created on: Wed 06 Nov 2013 05:38:12 AM EST
Database last updated on: Wed 06 Nov 2013 05:31:17 AM EST
===============================================================================
Report Summary:
===============================================================================
Host name: xxsi1242.gtk.gtech.com
Host IP address: 156.24.65.171
Host ID: None
Policy file used: /etc/tripwire/tw.pol
Configuration file used: /etc/tripwire/tw.cfg
Database file used: /var/lib/tripwire/xxsi1242.gtk.gtech.com.twd
Command line used: tripwire --check
===============================================================================
Rule Summary:
===============================================================================
-------------------------------------------------------------------------------
Section: Unix File System
-------------------------------------------------------------------------------
Rule Name Severity Level Added Removed Modified
--------- -------------- ----- ------- --------
Invariant Directories 66 0 0 0
Temporary directories 33 0 0 0
* Tripwire Data Files 100 0 0 1
Tech Stack 100 0 0 0
User binaries 66 0 0 0
Tripwire Binaries 100 0 0 0
* CLPS bins 100 0 0 2
CLPS Configuration files 100 0 0 0
ESCommon 100 0 0 0
Shell Binaries 100 0 0 0
OS executables and libraries 100 0 0 0
Security Control 100 0 0 0
ESCommon Configuration 100 0 0 0
(/etc/gtech/escommon)
Total objects scanned: 12358
Total violations found: 3
===============================================================================
Object Summary:
===============================================================================
-------------------------------------------------------------------------------
# Section: Unix File System
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
Rule Name: Tripwire Data Files (/etc/tripwire/tw.pol)
Severity Level: 100
-------------------------------------------------------------------------------
Modified:
"/etc/tripwire/tw.pol"
-------------------------------------------------------------------------------
Rule Name: CLPS bins (/opt/jboss/server)
Severity Level: 100
-------------------------------------------------------------------------------
Modified:
"/opt/jboss/server/esapps1/data/hypersonic/localDB.lck"
"/opt/jboss/server/gis/data/hypersonic/localDB.lck"
===============================================================================
Error Report:
===============================================================================
No Errors
-------------------------------------------------------------------------------
*** End of report ***
Note:
In the output I only am getting the files which are modified. I need the detail output for this. But unfortunately I am not getting what I expected. Please help me to proced further.
