If you run an integrity check and Tripwire
finds violations, you will first need to determine whether the
violations discovered are actual security breaches or the product of
authorized modifications. If you recently installed an application or
edited critical system files, Tripwire will
(correctly) report integrity check violations. In this case, you should
update your Tripwire database so those
changes are no longer reported as violations. However, if unauthorized
changes are made to system files that generate integrity check
violations, then you should restore the original file from a backup or
reinstall the program.
To update your Tripwire database to accept
the violations found in a report, you must specify the report you wish
to use to update the database. When issuing the command to integrate those valid
violations into your database, be sure to use the most recent report. Type the following
command (all on one line), where name is the name of the
report to be used:
/usr/sbin/tripwire --update --twrfile
/var/lib/tripwire/report/<name>.twr |
Tripwire will show you the particular report
using the default text editor (specified in the
Tripwire configuration file on the
EDITOR line). This is your chance to deselect files
that you do not wish to be updated in the
Tripwire database. It is important that you
only allow authorized integrity violations to be changed in the database.
All proposed updates to the Tripwire database start with a
[x] before the file name. If you want to
specifically exclude a valid violation from being added to the
Tripwire database, remove the
x from the box. To accept any files with an
x beside them as changes, write the file in the
editor and quit the text editor. This signals to
Tripwire to alter its database and not report
these files as violations.
For example, the default text editor for Tripwire is
vi. To write the file with vi and make the changes to the
Tripwire database when updating with a specific
report, type :wq in vi's command mode and press
[Enter]. You will be asked to enter your local
passphrase. Then, a new database file will be written to include the
valid violations.
After a new Tripwire database is written, the
newly authorized integrity violations will no longer show up as warnings
when the next integrity check is run.
