Chapter 11. Tripwire

151

Database file used:

/var/lib/tripwire/some.host.com.twd

Command line used:

/usr/sbin/tripwire   check

=======================================================================

Rule Summary:

=======================================================================

Section: Unix File System

Rule Name

Severity Level

Added

Removed

Modified

Invariant Directories

69

0

0

0

Temporary directories

33

0

0

0

* Tripwire Data Files

100

1

0

0

Critical devices

100

0

0

0

User binaries

69

0

0

0

Tripwire Binaries

100

0

0

0

11.6.2. View Tripwire Databases

You can also use

twprint

to view the entire database or information about selected files in the

Tripwire database. This is useful for seeing just how much information Tripwire is tracking on your

system.

To view the entire Tripwire database, type this command:

/usr/sbin/twprint  m d   print dbfile | less

This command will generate a large amount of output, with the first few lines appearing similar to

this:

Tripwire(R) 2.3.0 Database

Database generated by:

root

Database generated on:

Tue Jan

9 13:56:42 2001

Database last updated on:

Tue Jan

9 16:19:34 2001

=================================================================

Database Summary:

=================================================================

Host name:

some.host.com

Host IP address:

10.0.0.1

Host ID:

None

Policy file used:

/etc/tripwire/tw.pol

Configuration file used:

/etc/tripwire/tw.cfg

Database file used:

/var/lib/tripwire/some.host.com.twd

Command line used:

/usr/sbin/tripwire   init

=================================================================

Object Summary:

=================================================================

# Section: Unix File System

Mode

UID

Size

Modify Time

/

drwxr xr x

root (0)

XXX

XXXXXXXXXXXXXXXXX

/bin

drwxr xr x

root (0)

4096

Mon Jan

8 08:20:45 2001