Installation guide

148 Chapter 11. Tripwire
• EDITOR — Specifies the text editor called by Tripwire. The default value is /bin/vi.
• LATEPROMPTING — If set to true this variable configures Tripwire to wait as long as possible
before prompting the user for a password, thereby minimizing the amount of time the password is
in memory. The default value is false.
• LOOSEDIRECTORYCHECKING — If set to true this variable configures Tripwire to report if a file
within a watched directory changes and not to report the change for the directory itself. This limits
redundancy in Tripwire reports. The default value is false.
• SYSLOGREPORTING — If set to true, this variable configures Tripwire to report information to the
syslog daemon via the "user" facility. The log level is set to notice. See the syslogd man page
for more information. The default value is false.
• MAILNOVIOLATIONS — If set to true this variable configures Tripwire to email a report at a
regular interval regardless of whether or not any violations have occurred. The default value is
true.
• EMAILREPORTLEVEL — Specifies the level detail for emailed reports. Valid values for this variable
are 0 through 4. The default value is 3.
• REPORTLEVEL — Specifies the level detail for reports generated by the twprint command. This
value can be overridden on the command line, but is set to 3 by default.
• MAILMETHOD — Specifies which mail protocol Tripwire should use. Valid values are SMTP and
SENDMAIL. The default value is SENDMAIL.
• MAILPROGRAM — Specifies which mail program Tripwire should use. The default value is
/usr/sbin/sendmail -oi -t.
After editing the sample configuration file, you will need to configure the sample policy file.
Warning
For security purposes, you should either delete or store in a secure location any copies of the plain
text /etc/tripwire/twcfg.txt file after running the installation script or regenerating a signed con-
figuration file. Alternatively, you can change the permissions so that it is not world readable.
11.3.2. Edit /etc/tripwire/twpol.txt
Although it is not required, you should edit this heavily commented sample Tripwire policy file to take
into account the specific applications, files, and directories on your system. Relying on the unaltered
sample configuration from the RPM may not adequately protect your system.
Modifying the policy file also increases the usefulness of Tripwire reports by minimizing false alerts
for files and programs you are not using and by adding functionality, such as email notification.
Note
Notification via email is not configured by default. See Section 11.8.1 for more on configuring this
feature.
If you modify the sample policy file after running the configuration script, see Section 11.8 for in-
structions on regenerating a signed policy file.