- /etc/tripwire/tw.cfg
This is the encrypted Tripwire configuration file which
stores system-specific information, such as the location of
Tripwire data files. The twinstall.sh
installer script and twadmin command
generates this file using the information in the text version of
the configuration file,
/etc/tripwire/twcfg.txt.
After running the the installation script, the system
administrator can change parameters by editing
/etc/tripwire/twcfg.txt and regenerating a
signed copy of the tw.cfg file using the
twadmin command. See the Section called Updating the Tripwire Configuration File for more information on how
to do this.
- /etc/tripwire/tw.pol
The active Tripwire policy file is an encrypted file
containing comments, rules, directives, and variables. This file
dictates the way Tripwire checks your
system. Each rule in the policy file specifies a system object to be
monitored. Rules also describe which changes to the object to report and
which to ignore.
System objects are the files and directories you wish to
monitor. Each object is identified by an object name. A property
refers to a single characteristic of an object that Tripwire
software can monitor. Directives control conditional processing
of sets of rules in a policy file. During installation, the
sample text policy file ,
/etc/tripwire/twpol.txt, is used to
generate the active Tripwire policy file.
After running the the installation script, the system
administrator can update the Tripwire policy file by editing
/etc/tripwire/twpol.txt and regenerating a
signed copy of the tw.pol file using the
twadmin command. See the Section called Updating the Tripwire Policy File for more information on how
to do this.
- /var/lib/tripwire/host_name.twd
When first initialized, Tripwire uses the signed policy file
rules to create this database file. The Tripwire database is a
baseline snapshot of the system in a known secure
state. Tripwire compares this baseline against the current
system to determine what changes have occurred. This comparison
is called an integrity check.
- /var/lib/tripwire/report/host_name-date_of_report-time_of_report.twr
When you perform an integrity check, Tripwire produces
report files in the
/var/lib/tripwire/report/ directory. The
report files summarize any file changes that violated the policy
file rules during the integrity check. Tripwire reports are
named using the following convention:
host_name-date_of_report-time_of_report.twr.
These reports detail the differences between the Tripwire
database and your actual system files.
