لطفا منتظر باشید ...
Recipe 1.4 Basic Integrity Checking
1.4.1 Problem
You want to check whether any files
have been altered since the last Tripwire snapshot.
1.4.2 Solution
# tripwire --check
1.4.3 Discussion
This command is the lifeblood of Tripwire: has your system changed?
It compares the current state of your filesystem against the Tripwire
database, according to the rules in your active policy. The results
of the comparison are written to standard output and also stored as a
timestamped, signed Tripwire report.You can also perform a limited integrity check against one or more
files in the database. If your tripwire policy contains this rule:
(
rulename = "My funky files",
severity = 50
)
{
/sbin/e2fsck -> $(SEC_CRIT) ;
/bin/cp -> $(SEC_CRIT) ;
/usr/tmp -> $(SEC_INVARIANT) ;
/etc/csh.cshrc -> $(SEC_CONFIG) ;
}
you can check selected files and directories with:
# tripwire --check /bin/cp /usr/tmp
or all files in the given rule with:
# tripwire --check --rule-name "My funky files"
or all rules with severities greater than or equal to a given value:
# tripwire --check --severity 40
1.4.4 See Also
tripwire(8), and the Tripwire manual for policy syntax. You can
produce a help message with:
$ tripwire --check --help
