Tripwire File Location Reference

Before working with Tripwire, you should know where important files for the application are located. Tripwire stores its files in a variety of places depending on their role.

The next section explains more about the roles these files play in the Tripwire system.

Tripwire Components

The following describes in more detail the roles the listed in the previous section play in the Tripwire system.

/etc/tripwire/tw.cfg

This is the encrypted Tripwire configuration file which stores system-specific information, such as the location of Tripwire data files. The twinstall.sh installer script and twadmin command generates this file using the information in the text version of the configuration file, /etc/tripwire/twcfg.txt.

After running the the installation script, the system administrator can change parameters by editing /etc/tripwire/twcfg.txt and regenerating a signed copy of the tw.cfg file using the twadmin command. See the Section called Updating the Tripwire Configuration File for more information on how to do this.

/etc/tripwire/tw.pol

The active Tripwire policy file is an encrypted file containing comments, rules, directives, and variables. This file dictates the way Tripwire checks your system. Each rule in the policy file specifies a system object to be monitored. Rules also describe which changes to the object to report and which to ignore.

System objects are the files and directories you wish to monitor. Each object is identified by an object name. A property refers to a single characteristic of an object that Tripwire software can monitor. Directives control conditional processing of sets of rules in a policy file. During installation, the sample text policy file , /etc/tripwire/twpol.txt, is used to generate the active Tripwire policy file.

After running the the installation script, the system administrator can update the Tripwire policy file by editing /etc/tripwire/twpol.txt and regenerating a signed copy of the tw.pol file using the twadmin command. See the Section called Updating the Tripwire Policy File for more information on how to do this.

/var/lib/tripwire/host_name.twd

When first initialized, Tripwire uses the signed policy file rules to create this database file. The Tripwire database is a baseline snapshot of the system in a known secure state. Tripwire compares this baseline against the current system to determine what changes have occurred. This comparison is called an integrity check.

/var/lib/tripwire/report/host_name-date_of_report-time_of_report.twr

When you perform an integrity check, Tripwire produces report files in the /var/lib/tripwire/report/ directory. The report files summarize any file changes that violated the policy file rules during the integrity check. Tripwire reports are named using the following convention: host_name-date_of_report-time_of_report.twr. These reports detail the differences between the Tripwire database and your actual system files.