Chapter 11. Tripwire

147

2. If the CD ROM does not automatically mount, type the following command:

mount /mnt/cdrom

3. Verify that the

tripwire

RPM is on the CD ROM by typing:

ls /mnt/cdrom/RedHat/RPMS/ | grep tripwire

If the RPM is on the CD ROM, this command will display the package name.

If the RPM is not on the CD ROM, the shell prompt will return. In this case, you will need

to check CD 3 and, possibly, CD 1 of the Red Hat Linux 8.0 installation CD ROMs by first

unmounting the CD ROM then repeating steps one through three.

Unmount the CD ROM by right clicking on the CD ROM icon and selecting Eject or by typing

the following command at the shell prompt:

umount /mnt/cdrom

4. Once you have located the

tripwire

RPM, install it by typing the following command as the

root user:

rpm  Uvh /mnt/cdrom/RedHat/RPMS/tripwire*.rpm

In the

/usr/share/doc/tripwire  version number /

directory, you will find release notes

N

O

and README files for Tripwire. These documents contain important information about the default

policy file and other topics.

11.3. Customizing Tripwire

After you have installed the Tripwire RPM, you need to complete the following steps to initialize the

software:

11.3.1. Edit

/etc/tripwire/twcfg.txt

Although you are not required to edit this sample Tripwire configuration file, you may find it necessary

for your situation. For instance you may want to alter the location of Tripwire files, customize email

settings, or customize the level of detail for reports.

Below is a list of required user configurable variables in the

/etc/tripwire/twcfg.txt

file:

  POLFILE

  Specifies the location of the policy file;

/etc/tripwire/tw.pol

is the default value.

  DBFILE

  Specifies the location of the database file;

/var/lib/tripwire/$(HOSTNAME).twd

is the default value.

  REPORTFILE

  Specifies the location of the report files. By default this value is set to

/var/lib/tripwire/report/$(HOSTNAME) $(DATE).twr

.

  SITEKEYFILE

  Specifies the location of the site key file;

/etc/tripwire/site.key

is the

default value.

  LOCALKEYFILE

  Specifies the location of the local key file;

/etc/tripwire/$(HOSTNAME) 

local.key

is the default value.

Important

If you edit the configuration file and leave any of the above variables undefined, the configuration file

will be invalid. If this occurs, when you execute the tripwire command it will report an error and exit.

The rest of the configurable variables in the sample

/etc/tripwire/twcfg.txt

file are optional.

These include the following: