Ajuda do Tripwire Obrigatório

Question

Eu criei o arquivo de políticas no Tripwire e também criei as regras mencionadas abaixo:

/opt/jboss/server/gis/conf -> $(SEC_CONFIG) +aipm +c+g+a+i+s+t+u+l+M;

/usr/local/gtech/eseries/ -> $(SEC_CONFIG) +a+c+g+i+s+t+u+l+M ;

Depois de executar a verificação de integridade, a saída deve ser a(Access timestamp),c (Inode timestamp (create/modify),g (File owner's group ID),i (Inode number),s (File size),t (time stamp),u (File owner's user ID),l(File is increasing in size (a "growing file"),M (MD5 hash value) .

Estou obtendo a saída como abaixo:

[root@xxsi1242 tripwire]# tripwire --check
 Parsing policy file: /etc/tripwire/tw.pol
 *** Processing Unix File System ***
 Performing integrity check...
 Wrote report file: /var/lib/tripwire/report/xxsi1242.gtk.gtech.com-20131106-053812.twr


Open Source Tripwire(R) 2.4.1 Integrity Check Report

Report generated by: root
 Report created on: Wed 06 Nov 2013 05:38:12 AM EST
 Database last updated on: Wed 06 Nov 2013 05:31:17 AM EST

===============================================================================
 Report Summary:
 ===============================================================================

Host name: xxsi1242.gtk.gtech.com
 Host IP address: 156.24.65.171
 Host ID: None
 Policy file used: /etc/tripwire/tw.pol
 Configuration file used: /etc/tripwire/tw.cfg
 Database file used: /var/lib/tripwire/xxsi1242.gtk.gtech.com.twd
 Command line used: tripwire --check

===============================================================================
 Rule Summary:
 ===============================================================================

-------------------------------------------------------------------------------
 Section: Unix File System
 -------------------------------------------------------------------------------

Rule Name Severity Level Added Removed Modified
 --------- -------------- ----- ------- --------
 Invariant Directories 66 0 0 0
 Temporary directories 33 0 0 0
 * Tripwire Data Files 100 0 0 1
 Tech Stack 100 0 0 0
 User binaries 66 0 0 0
 Tripwire Binaries 100 0 0 0
 * CLPS bins 100 0 0 2
 CLPS Configuration files 100 0 0 0
 ESCommon 100 0 0 0
 Shell Binaries 100 0 0 0
 OS executables and libraries 100 0 0 0
 Security Control 100 0 0 0
 ESCommon Configuration 100 0 0 0
 (/etc/gtech/escommon)

Total objects scanned: 12358
 Total violations found: 3

===============================================================================
 Object Summary:
 ===============================================================================

-------------------------------------------------------------------------------
 # Section: Unix File System
 -------------------------------------------------------------------------------

-------------------------------------------------------------------------------
 Rule Name: Tripwire Data Files (/etc/tripwire/tw.pol)
 Severity Level: 100
 -------------------------------------------------------------------------------

Modified:
 "/etc/tripwire/tw.pol"

-------------------------------------------------------------------------------
 Rule Name: CLPS bins (/opt/jboss/server)
 Severity Level: 100
 -------------------------------------------------------------------------------

Modified:
 "/opt/jboss/server/esapps1/data/hypersonic/localDB.lck"
 "/opt/jboss/server/gis/data/hypersonic/localDB.lck"

===============================================================================
 Error Report:
 ===============================================================================

No Errors

-------------------------------------------------------------------------------
 *** End of report ***

Nota:

Na saída eu só estou recebendo os arquivos que são modificados. Eu preciso da saída detalhada para isso. Mas infelizmente não estou conseguindo o que esperava. Por favor me ajude a seguir adiante.

    

Answer 1

A adição de '-v' à linha de comando, para o modo detalhado, gera a informação desejada? O arquivo de relatório do tripwire (* .twr) tem a informação que você deseja?