[PLUG] Tripwire setup

[Mike Pflugfelder <mikep@keyinfosys.com>]

About a month ago, I rebuilt one of my RH Linux servers as a result of the
machine being hacked from someone on the internet.  Well, in the process of
building the new machine, I install Tripwire from the install CD.

When I first initialized the database, I got an error stating that it
couldn't find /etc/tripwire/localhost-local.key.  I think that I might have
initialized the database while the server had no hostname / domainname.  I
just got around to doing a re-init and I'm finding the same message:

# tripwire --init
Please enter your local passphrase:
Parsing policy file: /etc/tripwire/tw.pol
Generating the database...
*** Processing Unix File System ***
### Warning: File system error.
### Filename: /etc/tripwire/localhost-local.key
### No such file or directory
### Continuing...
Wrote database file: /var/lib/tripwire/<hostname omitted>.twd
The database was successfully generated.

Does anyone else have some ideas about this?  It seems to me to only be an
annoyance as it shows up in my nightly checks, but I wasn't sure if there is
more to it than I can tell.  Also, I've checked the policy, and find no
references to that file there, but I do find the following reference in the
configuration file:

# twadmin -m f | grep "/etc/tripwire/" | more
POLFILE                =/etc/tripwire/tw.pol
SITEKEYFILE            =/etc/tripwire/site.key
LOCALKEYFILE           =/etc/tripwire/$(HOSTNAME)-local.key

If this is supposed to be my local key file, I would suspect that when I do
anything that asks me for my local key, it would bomb out, but that isn't
the case.

-Mike

______________________________________________________________________
Philadelphia Linux Users Group       -      http://www.phillylinux.org
Announcements-http://lists.phillylinux.org/mail/listinfo/plug-announce
General Discussion  -  http://lists.phillylinux.org/mail/listinfo/plug