Назад | Перейти на главную страницу

Требуется помощь Tripwire

Я создал файл политики в Tripwire, а также создал правила, упомянутые ниже:

/opt/jboss/server/gis/conf -> $(SEC_CONFIG) +aipm +c+g+a+i+s+t+u+l+M;

/usr/local/gtech/eseries/ -> $(SEC_CONFIG) +a+c+g+i+s+t+u+l+M ;

После запуска проверки целостности вывод должен быть a(Access timestamp),c (Inode timestamp (create/modify),g (File owner's group ID),i (Inode number),s (File size),t (time stamp),u (File owner's user ID),l(File is increasing in size (a "growing file"),M (MD5 hash value).

Я получаю результат, как показано ниже:

[root@xxsi1242 tripwire]# tripwire --check
 Parsing policy file: /etc/tripwire/tw.pol
 *** Processing Unix File System ***
 Performing integrity check...
 Wrote report file: /var/lib/tripwire/report/xxsi1242.gtk.gtech.com-20131106-053812.twr


Open Source Tripwire(R) 2.4.1 Integrity Check Report

Report generated by: root
 Report created on: Wed 06 Nov 2013 05:38:12 AM EST
 Database last updated on: Wed 06 Nov 2013 05:31:17 AM EST

===============================================================================
 Report Summary:
 ===============================================================================

Host name: xxsi1242.gtk.gtech.com
 Host IP address: 156.24.65.171
 Host ID: None
 Policy file used: /etc/tripwire/tw.pol
 Configuration file used: /etc/tripwire/tw.cfg
 Database file used: /var/lib/tripwire/xxsi1242.gtk.gtech.com.twd
 Command line used: tripwire --check

===============================================================================
 Rule Summary:
 ===============================================================================

-------------------------------------------------------------------------------
 Section: Unix File System
 -------------------------------------------------------------------------------

Rule Name Severity Level Added Removed Modified
 --------- -------------- ----- ------- --------
 Invariant Directories 66 0 0 0
 Temporary directories 33 0 0 0
 * Tripwire Data Files 100 0 0 1
 Tech Stack 100 0 0 0
 User binaries 66 0 0 0
 Tripwire Binaries 100 0 0 0
 * CLPS bins 100 0 0 2
 CLPS Configuration files 100 0 0 0
 ESCommon 100 0 0 0
 Shell Binaries 100 0 0 0
 OS executables and libraries 100 0 0 0
 Security Control 100 0 0 0
 ESCommon Configuration 100 0 0 0
 (/etc/gtech/escommon)

Total objects scanned: 12358
 Total violations found: 3

===============================================================================
 Object Summary:
 ===============================================================================

-------------------------------------------------------------------------------
 # Section: Unix File System
 -------------------------------------------------------------------------------

-------------------------------------------------------------------------------
 Rule Name: Tripwire Data Files (/etc/tripwire/tw.pol)
 Severity Level: 100
 -------------------------------------------------------------------------------

Modified:
 "/etc/tripwire/tw.pol"

-------------------------------------------------------------------------------
 Rule Name: CLPS bins (/opt/jboss/server)
 Severity Level: 100
 -------------------------------------------------------------------------------

Modified:
 "/opt/jboss/server/esapps1/data/hypersonic/localDB.lck"
 "/opt/jboss/server/gis/data/hypersonic/localDB.lck"

===============================================================================
 Error Report:
 ===============================================================================

No Errors

-------------------------------------------------------------------------------
 *** End of report ***

Примечание:

На выходе я получаю только измененные файлы. Для этого мне нужен подробный вывод. Но, к сожалению, я не получаю того, чего ожидал. Пожалуйста, помогите мне продолжить работу.

Добавляет ли '-v' в командную строку для подробного режима нужную информацию? Есть ли в файле отчета tripwire (* .twr) нужная информация?