148

Chapter 11. Tripwire

  EDITOR

  Specifies the text editor called by Tripwire. The default value is

/bin/vi

.

  LATEPROMPTING

  If set to

true

this variable configures Tripwire to wait as long as possible

before prompting the user for a password, thereby minimizing the amount of time the password is

in memory. The default value is

false

.

  LOOSEDIRECTORYCHECKING

  If set to

true

this variable configures Tripwire to report if a file

within a watched directory changes and not to report the change for the directory itself. This limits

redundancy in Tripwire reports. The default value is

false

.

  SYSLOGREPORTING

  If set to

true

, this variable configures Tripwire to report information to the

syslog daemon via the "user" facility. The log level is set to

notice

. See the

syslogd

man page

for more information. The default value is

false

.

  MAILNOVIOLATIONS

  If set to

true

this variable configures Tripwire to email a report at a

regular interval regardless of whether or not any violations have occurred. The default value is

true

.

  EMAILREPORTLEVEL

  Specifies the level detail for emailed reports. Valid values for this variable

are

0

through

4

. The default value is

3

.

  REPORTLEVEL

  Specifies the level detail for reports generated by the

twprint

command. This

value can be overridden on the command line, but is set to

3

by default.

  MAILMETHOD

  Specifies which mail protocol Tripwire should use. Valid values are

SMTP

and

SENDMAIL

. The default value is

SENDMAIL

.

  MAILPROGRAM

  Specifies which mail program Tripwire should use. The default value is

/usr/sbin/sendmail  oi  t

.

After editing the sample configuration file, you will need to configure the sample policy file.

Warning

For security purposes, you should either delete or store in a secure location any copies of the plain

text /etc/tripwire/twcfg.txt file after running the installation script or regenerating a signed con 

figuration file. Alternatively, you can change the permissions so that it is not world readable.

11.3.2. Edit

/etc/tripwire/twpol.txt

Although it is not required, you should edit this heavily commented sample Tripwire policy file to take

into account the specific applications, files, and directories on your system. Relying on the unaltered

sample configuration from the RPM may not adequately protect your system.

Modifying the policy file also increases the usefulness of Tripwire reports by minimizing false alerts

for files and programs you are not using and by adding functionality, such as email notification.

Note

Notification via email is not configured by default. See Section 11.8.1 for more on configuring this

feature.

If you modify the sample policy file after running the configuration script, see Section 11.8 for in 

structions on regenerating a signed policy file.