PythonQ 248-8XX Guide d'installation télécharger pdf (Page 145)

Chapter 11.

Tripwire

Tripwire data integrity assurance software monitors the reliability of critical system ﬁles and directo-

ries by identifying changes made to them. Tripwire conﬁguration options include the ability to receive

alerts via email if particular ﬁles are altered and automated integrity checking via a cron job. Using

Tripwire for intrusion detection and damage assessment helps you keep track of system changes. Be-

cause Tripwire can positively identify ﬁles that have been added, modiﬁed, or deleted, it can speed

recovery from a break-in by keeping the number of ﬁles which must be restored to a minimum.

Tripwire compares ﬁles and directories against a database of ﬁle locations, dates modiﬁed, and other

data. The database contains baselines, which are snapshots of speciﬁed ﬁles and directories at a spe-

ciﬁc point in time. The contents of the baseline database should be generated before the system is at

risk of intrusion. After creating the baseline database, Tripwire then compares the current system to

the baseline and reports any modiﬁcations, additions, or deletions.

While Tripwire is a valuable tool for auditing the security state of Red Hat Linux systems, Tripwire is

not supported by Red Hat, Inc. Refer to the Tripwire project’s website (http://www.tripwire.org) for

more information about Tripwire.

11.1. How to Use Tripwire

The following ﬂowchart illustrates how Tripwire works:

Figure 11-1. Using Tripwire

The following describes in more detail the numbered blocks shown in Figure 11-1

1 2 ... 140 141 142 143 144 145 146 147 148 149 150 ... 293 294

Pas de commentaire

PythonQ 248-8XX Guide d'installation Page 145