Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 76877 - tripwire needs to be "rpm aware"
tripwire needs to be "rpm aware"
Status: CLOSED WONTFIX
Product: Red Hat Linux
Classification: Retired
Component: tripwire (Show other bugs)
7.2
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Florian La Roche
David Lawrence
: FutureFeature
: 58910 (view as bug list)
Depends On:
Blocks:
  Show dependency tree / graph
 
Reported: 2002-10-28 11:47 EST by Red Hat Production Operations
Modified: 2007-04-18 12:47 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-04-21 20:48:52 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

  None (edit)
Description Need Real Name 2002-10-28 11:47:29 EST 
Description of Problem:

Setting up tripwire is a lot of work initially, as the default twpol.txt file
looks like it was created based on an "everything" installation, so during the
initial setup on a more typical system, a lot of references need to be 
commented so that the the database will initialize cleanly and the nightly
reports will not show row after row of things like this:

### Warning: File system error.
### Filename: /proc/rtc
### No such file or directory
### Continuing...

If each RPM package dropped a portion of a config file into /etc/tripwire.d
(for sake of discussion purposes) and the files in that directory were later
combined to create /etc/tripwire/twpol.txt, or tripwire was able to read those
files directly, this would not only solve the initial configuration issue, but
also the case where a package is later added to the system, and the policy file
needs to be updated to reflect it.  

It is very easy to imagine that a new package is installed during an errata
update and the sysadmin may not think to update the policy file, or may only
partially update it since there are so many sections to touch, or may add the
wrong files to the wrong sections of the policy file.

Version-Release number of selected component (if applicable):

tripwire-2.3.1-5
Comment 1 W. Michael Petullo 2002-11-11 10:52:39 EST 
I agree 100% with Andrew's comments.  Currently, twpol.txt is a BEAST to
maintain.    I think that one of the following two techniques should be used:

1.  (Andrew's idea)  RPM packages install twpol.txt fragments into
/etc/tripwire.d.  The problem is that every RPM package would need to be
modified to provide this information to tripwire.  Any people who don't use
tripwire might not want their systems cluttered with this otherwise useless data.

2.  Write a tool that queries a system's RPM database and generates a reasonable
twpol.txt.  An administrator could review this file and initialize tripwire
using it.  This is really what package management tools like RPM are for, right?
 They should provide users with information about what is on their systems.  

Combining ideas one and two, RPM could even be enhanced with security-related
database entries.  These entries could be queried using the new, streamlined
version 2.0 of the tool developed for technque two.  Imagine:

# rpm -qz util-linux
/bin/arch ReadOnly
/bin/dmesg ReadOnly
/etc/fdprm Dynamic
...
/var/log/just_to_prove_a_point Growing
...

# rpm -qz some_package
ERROR: Package author has not provided security information

Now THAT's cool (but would require additions to the RPM specification).
Comment 2 Jeff Johnson 2002-11-11 11:04:11 EST 
Hint: rpm-4.1 verifies digital signatures
whenever a header is read. Headers contain MD5
sums for files.

So on the todo list is to teach tripwire how to
read an rpm database. and to teach rpm --verify
to do a couple more tasks that tripwire does.
Comment 3 Jeff Johnson 2002-11-16 15:32:44 EST 
*** Bug 58910 has been marked as a duplicate of this bug. ***
Comment 4 John Thacker 2006-04-21 20:48:52 EDT 
Closing bug, since tripwire hasn't been shipped for so long, only in Legacy
releases.
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.