Section: Devices and Network Interfaces (4)
Updated: 1 July 2000Index
Return to Main Contents
twconfig - Tripwire
configuration file reference
The configuration file stores system-specific information, including the
location of Tripwire data files, and the settings used to send
email notification. The configuration file settings are
generated during the installation process, but can be changed by the system
administrator at any time. The configuration file is
signed with the site key, and the site passphrase is
required to edit the file.
During installation, a signed Tripwire configuration file tw.cfg will be created in the /etc/tripwire directory, and a plain text copy of this configuration file twcfg.txt will be created in the same directory.
The configuration file is modified using the
command. With this command, the user can designate
an existing plain text file as the current configuration file.
Using the current site key and passphrase, the new configuration file
is cryptographically signed and saved with this command.
Components of the Configuration File
configuration file is structured as a list of
keyword-value pairs, and may also contain comments and variable
definitions. Any lines with "#" in the first column are treated as
The general syntax for variable definition is:
keyword = value
ROOT = /usr/tripwire
EDITOR = /usr/local/bin/jove
Variable substitution on the right hand side is permitted using the syntax:
$( varname )
DBFILE = $(ROOT)/db/$(HOSTNAME).twd
Variable names are case-sensitive, and may contain all alphanumeric
characters, underscores, the characters "+-@:", and the period.
Two variables are predefined in the configuration file, and may
not be changed. HOSTNAME is the
unqualified hostname that Tripwire is running on, and
is a string representation of the date and time.
The following variables must be set in order for Tripwire
operate. The values listed below are assigned during installation.
POLFILE Default = /etc/tripwire/tw.pol
DBFILE Default = /var/lib/tripwire/$(HOSTNAME).twd
REPORTFILE Default = /var/lib/tripwire/report/$(HOSTNAME)-$(DATE).twr
SITEKEYFILE Default = /etc/tripwire/site.key
LOCALKEYFILE Default = /etc/tripwire/$(HOSTNAME)-local.key
The following variables are not required to run Tripwire
some of the program's functionality will be lost without them. The
values assigned during installation are listed.
Specifies an editor to be used in interactive modes. If EDITOR
is not defined, and no editor is specified on the command line, using
interactive modes will cause an error.
Initial value: /bin/vi
This variable can be set to the location to which tripwire should write
its temporary files. By default it is /tmp, which due to the default
permissions can be very insecure. It is recommended that you use this
configuration variable to provide tripwire with a secure place to write
temporary files. The directory used should have its permissions set such
that only the owning process can read/write to it, i.e. "chmod 700".
Initial value: /tmp
This variable is set to a list of email addresses separated by either
a comma ",", or semi-colon ";". If a report would have normally been
sent out, it will also be send to this list of recipients.
Initial value: none
Prompt for passphrase as late as possible to minimize the amount of
time that the passphrase is stored in memory. If the value is
true (case-sensitive), then late prompting is turned on. With
any other value, or if the variable is removed from the configuration
file, late prompting is turned off.
Initial value: false
When a file is added or removed from a directory, Tripwire
reports both the changes to the file itself, and the modification to
the directory (size, num links, etc.). This can create redundant
entries in Tripwire reports. With loose directory checking,
Tripwire will not check directories for any properties that would
change when a file was added or deleted. This includes: size, number
of links, access time, change time, modification time, number of blocks,
growing file, and all hashes.
If the value for this variable is true (case-sensitive),
then loose directory checking is turned on, and these
properties will be ignored for all directories. With any other value,
or if the variable is removed from the configuration file, loose
directory checking is turned off. Turning loose directory checking
on is equivalent to appending the following propertymask to
the rules for all directory inodes:
Initial value: false
If this variable is set to true, messages are sent
to the syslog for four events: database initialization,
integrity check completions, database updates, and policy updates.
The syslog messages are sent from the "user" facility at
the "notice" level. For more information, see the
man page and the
file. The following illustrates the information logged
in the syslog for each of the four events:
Jun 18 14:09:42 lighthouse tripwire: Database initialized:
Jun 18 14:10:57 lighthouse tripwire: Integrity Check Complete:
TWReport lighthouse 20000618141057 V:2 S:90 A:1 R:0 C:1
Jun 18 14:11:19 lighthouse tripwire: Database Update Complete:
Jun 18 14:18:26 lighthouse tripwire: Policy Update Complete:
The letters in the Integrity Checking log correspond to # of
violations, maximum severity level, and # of files added,
deleted, and changed,
respectively. With any value other than true, or if this
variable is removed from the configuration file, syslog reporting will
be turned off.
Initial value: true
Specifies the default level of report produced by the twprint
--print-report mode. Valid values for this option are 0 to
4. The report
level specified by this option can be overridden with the (-t or --report-level) option on the command line. If
this variable is not included in the configuration file, the default
report level is 3. Note that only reports printed using the
twprint --print-report mode are affected by this
parameter; reports displayed by other modes and other commands
are not affected.
Initial value: 3
Email Notification Variables
Specifies the protocol to be used by Tripwire for email
notification. The only acceptable values for this field are
SMTP or SENDMAIL. Any other value will
produce an error message.
Initial value: SENDMAIL
Specifies the domain name or IP address of the SMTP server used for
email notification. Ignored unless MAILMETHOD is set to
Initial value: mail.domain.com
Specifies the port number used with SMTP. Ignored unless
MAILMETHOD is set to SMTP.
Initial value: 25
Specifies the program used for email reporting of rule violations if
MAILMETHOD is set to SENDMAIL. The program must take
an RFC822 style mail header, and recipients will be listed in the "To:"
field of the mail header. Some mail programs interpret a line
consisting of only a single period character to mean
end-of-input, and all text after that is ignored. Since there is
a small possibility that a
report would contain such a line, the mail program specified must be
able to ignore lines that consist of a single period (the -oi
option to sendmail produces this behavior).
Initial value: /usr/lib/sendmail -oi -t
Specifies the default level of report produced by the tripwire
--check mode email report. Valid values for this option are 0
to 4. The
report level specified by this option can be overridden with the
(-t or --email-report-level) option on the
command-line. If this variable is not included in the configuration
file, the default report level is 3.
Initial value: 3
This option controls the way that Tripwire sends email
notification if no rule violations are found during an integrity check.
If MAILNOVIOLATIONS is set to false and no violations
are found, Tripwire will not send a report. With any other value,
or if the variable is removed from the configuration file,
Tripwire will send an email message stating that no violations
Mailing reports of no violations allows an administrator to distinguish
between unattended integrity checks that are failing to run and
integrity checks that are running but are not finding any violations.
However, mailing no violations reports will increase the amount of data
that must be processed.
Initial value: true
This man page describes
Permission is granted to make and distribute verbatim copies of this man page provided the copyright notice and this permission notice are preserved on all copies.
Permission is granted to copy and distribute modified versions of this man page under the conditions for verbatim copying, provided that the entire resulting derived work is distributed under the terms of a permission notice identical to this one.
Permission is granted to copy and distribute translations of this man page into another language, under the above conditions for modified versions, except that this permission notice may be stated in a translation approved by Tripwire, Inc.
Copyright 2000 Tripwire, Inc. Tripwire is a registered trademark of Tripwire, Inc. in the United States and other countries. All rights reserved.
- Components of the Configuration File
- Required Variables
- Other Variables
- Email Notification Variables
- VERSION INFORMATION
- COPYING PERMISSIONS
- SEE ALSO