##############################################################################
# ##
############################################################################## #
# # #
# Policy file for Red Hat Linux # #
# ##
##############################################################################
##############################################################################
# ##
############################################################################## #
# # #
# Global Variable Definitions # #
# # #
# These are defined at install time by the installation script. You may # #
# Manually edit these if you are using this file directly and not from the # #
# installation script itself. # #
# ##
##############################################################################
@@section GLOBAL
TWDOCS="/usr/local/doc/tripwire";
TWBIN="/usr/local/sbin";
TWPOL="/usr/local/etc";
TWDB="/usr/local/lib/tripwire";
TWSKEY="/usr/local/etc";
TWLKEY="/usr/local/etc";
TWREPORT="/usr/local/lib/tripwire/report";
HOSTNAME=centos.test;
##############################################################################
# Predefined Variables #
##############################################################################
#
# Property Masks
#
# - ignore the following properties
# + check the following properties
#
# a access timestamp (mutually exclusive with +CMSH)
# b number of blocks allocated
# c inode creation/modification timestamp
# d ID of device on which inode resides
# g group id of owner
# i inode number
# l growing files (logfiles for example)
# m modification timestamp
# n number of links
# p permission and file mode bits
# r ID of device pointed to by inode (valid only for device objects)
# s file size
# t file type
# u user id of owner
#
# C CRC-32 hash
# H HAVAL hash
# M MD5 hash
# S SHA hash
#
##############################################################################
Device = +pugsdr-intlbamcCMSH ;
Dynamic = +pinugtd-srlbamcCMSH ;
Growing = +pinugtdl-srbamcCMSH ;
IgnoreAll = -pinugtsdrlbamcCMSH ;
IgnoreNone = +pinugtsdrbamcCMSH-l ;
ReadOnly = +pinugtsdbmCM-rlacSH ;
Temporary = +pugt ;
@@section FS
########################################
# ##
######################################## #
# # #
# Tripwire Binaries and Data Files # #
# ##
########################################
# Tripwire Binaries
(
rulename = "Tripwire Binaries",
)
{
$(TWBIN)/siggen -> $(ReadOnly) ;
$(TWBIN)/tripwire -> $(ReadOnly) ;
$(TWBIN)/twadmin -> $(ReadOnly) ;
$(TWBIN)/twprint -> $(ReadOnly) ;
}
# Tripwire Data Files - Configuration Files, Policy Files, Keys, Reports, Databases
(
rulename = "Tripwire Data Files",
)
{
# NOTE: We remove the inode attribute because when Tripwire creates a backup,
# it does so by renaming the old file and creating a new one (which will
# have a new inode number). Inode is left turned on for keys, which shouldn't
# ever change.
# NOTE: The first integrity check triggers this rule and each integrity check
# afterward triggers this rule until a database update is run, since the
# database file does not exist before that point.
$(TWDB) -> $(Dynamic) -i ;
$(TWPOL)/tw.pol -> $(ReadOnly) -i ;
$(TWPOL)/tw.cfg -> $(ReadOnly) -i ;
$(TWLKEY)/$(HOSTNAME)-local.key -> $(ReadOnly) ;
$(TWSKEY)/site.key -> $(ReadOnly) ;
# don't scan the individual reports
$(TWREPORT) -> $(Dynamic) (recurse=0) ;
}
################################################
# ##
################################################ #
# # #
# RPM Checksum Files # #
# ##
################################################
(
rulename = "RPM Checksum Files",
)
{
/var/lib/rpm -> $(ReadOnly);
/var/lib/rpm/__db.001 -> $(Dynamic) ;
/var/lib/rpm/__db.002 -> $(Dynamic) ;
/var/lib/rpm/__db.003 -> $(Dynamic) ;
}
################################################
# ##
################################################ #
# # #
# Global Configuration Files (/etc/) # #
# ##
################################################
(
rulename = "Global Configuration Files",
)
{
/etc -> $(IgnoreNone) -SHa ;
/etc/adjtime -> $(Dynamic) ;
/etc/aliases.db -> $(Dynamic) ;
/etc/bashrc -> $(Dynamic) ;
/etc/csh.cshrc -> $(Dynamic) ;
/etc/csh.login -> $(Dynamic) ;
/etc/mail/statistics -> $(Growing) ;
/etc/profile -> $(Dynamic) -i ;
/etc/mtab -> $(Dynamic) -i ;
/etc/rc.d -> $(IgnoreNone) -SHa ;
/etc/sysconfig -> $(IgnoreNone) -SHa ;
/etc/sysconfig/hwconf -> $(Dynamic) -m ;
}
################################################
# ##
################################################ #
# # #
# OS Boot Files and Mount Points # #
# ##
################################################
(
rulename = "OS Boot Files and Mount Points",
)
{
/boot -> $(ReadOnly) ;
/cdrom -> $(Dynamic) ;
/floppy -> $(Dynamic) ;
/mnt -> $(Dynamic) ;
}
################################################
# ##
################################################ #
# # #
# OS Devices and Misc Directories # #
# ##
################################################
(
rulename = "OS Devices and Misc Directories",
)
{
/dev -> $(Device) ;
/initrd -> $(Dynamic) ;
/opt -> $(Dynamic) ;
/lost+found -> $(Dynamic) ;
/var/lost+found -> $(Dynamic) ;
/home/lost+found -> $(Dynamic) ;
!/dev/pts ; # Ignore this file
!/dev/shm ; # Ignore this file
}
################################################
# ##
################################################ #
# # #
# OS Binaries and Libraries # #
# ##
################################################
(
rulename = "OS Binaries and Libraries",
)
{
/bin -> $(ReadOnly) ;
/lib -> $(ReadOnly) ;
/sbin -> $(ReadOnly) ;
/usr/bin -> $(ReadOnly) ;
/usr/lib -> $(ReadOnly) ;
/usr/libexec -> $(ReadOnly) ;
/usr/sbin -> $(ReadOnly) ;
/usr/X11R6/lib -> $(ReadOnly) ;
}
################################################
# ##
################################################ #
# # #
# User Binaries and Libraries # #
# ##
################################################
(
rulename = "User Binaries and Libraries",
)
{
!/home/local;
/usr/local -> $(ReadOnly) ;
/usr/local/bin -> $(ReadOnly) ;
/usr/local/doc -> $(ReadOnly) ;
/usr/local/etc -> $(ReadOnly) ;
/usr/local/games -> $(ReadOnly) ;
/usr/local/include -> $(ReadOnly) ;
/usr/local/lib -> $(ReadOnly) ;
/usr/local/libexec -> $(ReadOnly) ;
/usr/local/man -> $(ReadOnly) ;
/usr/local/sbin -> $(ReadOnly) ;
/usr/local/share -> $(ReadOnly) ;
/usr/local/src -> $(ReadOnly) ;
/usr/local/sysinfo -> $(ReadOnly) ;
}
################################################
# ##
################################################ #
# # #
# Root Directory and Files # #
# ##
################################################
(
rulename = "Root Directory and Files",
)
{
/root -> $(IgnoreNone) -SHa ;
/root/.bashrc -> $(Dynamic) ;
/root/.bash_history -> $(Dynamic) ;
#/root/.bash_logout -> $(Dynamic) ;
/root/.bash_profile -> $(Dynamic) ;
/root/.cshrc -> $(Dynamic) ;
#/root/.enlightenment -> $(Dynamic) ;
#/root/.esd-auth -> $(Dynamic) ;
!/root/.gconf ;
!/root/.gconfd ;
#/root/.gnome -> $(Dynamic) ;
#/root/.gnome-desktop -> $(Dynamic) ;
#/root/.gnome2 -> $(Dynamic) ;
#/root/.gtkrc -> $(Dynamic) ;
#/root/.gtkrc-1.2-gnome2 -> $(Dynamic) ;
#/root/.metacity -> $(Dynamic) ;
#/root/.nautilus -> $(Dynamic) ;
#/root/.rhn-applet.conf -> $(Dynamic) ;
#/root/.tcshrc -> $(Dynamic) ;
#/root/.xauth -> $(Dynamic) ;
#/root/.ICEauthority -> $(Dynamic) ;
#/root/.Xauthority -> $(Dynamic) -i ;
#/root/.Xresources -> $(Dynamic) ;
}
################################################
# ##
################################################ #
# # #
# Temporary Directories # #
# ##
################################################
(
rulename = "Temporary Directories",
)
{
/usr/tmp -> $(Temporary) ;
/var/tmp -> $(Temporary) ;
/tmp -> $(Temporary) ;
#/tmp/.fam-socket -> $(Temporary) ;
#/tmp/.ICE-unix -> $(Temporary) ;
#/tmp/.X11-unix -> $(Temporary) ;
!/tmp/orbit-root ;
}
################################################
# ##
################################################ #
# # #
# System Boot Changes # #
# ##
################################################
(
rulename = "System Boot Changes",
)
{
/.autofsck -> $(Dynamic) -m ;
/var/cache/man/whatis -> $(Growing) ;
/var/lib/logrotate.status -> $(Growing) ;
#/var/lib/nfs/statd -> $(Growing) ;
!/var/lib/random-seed ;
#/var/lib/slocate/slocate.db -> $(Growing) -is ;
/var/lock/subsys -> $(Dynamic) -i ;
/var/log -> $(Growing) -i ;
!/var/log/sa;
!/var/log/cisco;
/var/run -> $(Dynamic) -i ;
/etc/cron.daily -> $(Growing);
/etc/cron.weekly -> $(Growing);
/etc/cron.monthly -> $(Growing);
/var/spool/mail -> $(Growing);
}
################################################
# ##
################################################ #
# # #
# Monitor Filesystems # #
# ##
################################################
(
rulename = "Monitor Filesystems",
)
{
/ -> $(ReadOnly) ;
/home -> $(ReadOnly) ; # Modify as needed
/usr -> $(ReadOnly) ;
/var -> $(ReadOnly) ;
}
################################################
# ##
################################################ #
# # #
# Proc Filesystem # #
# ##
################################################
(
rulename = "Proc Filesystem",
)
{
!/proc ; # Ignore most of this directory
}
|