Tripwire
From Alessandro's Wiki
- tripwire is a security tool to check for modified system files.
configuration / installation
installaing from repositories
- debian based
apt-get install tripwire
- red-hat based
yum install tripwire
- gentoo
emerge app-admin/tripwire
first run
- first install:
/etc/tripwire/twinstall.sh
- Generate database with passwords:
tripwire -m i
- edit config file:
vi /etc/tripwire/twcfg.txt
- change this to false at first run. Put it back to true after directory rescan.
LOOSEDIRECTORYCHECKING =true
- edit policy file:
vi /etc/tripwire/twpol.txt
- adapt policy to the system:
tripwire --update-policy -Z low /etc/tripwire/twpol.txt
gentoo specific
- here is a BASH script to generate the configuration from installed packages:
https://34662.bugs.gentoo.org/attachment.cgi?id=269983
... from this post: https://bugs.gentoo.org/34662?id=34662
... from this wiki http://en.gentoo-wiki.com/wiki/Tripwire