🚀 go-pugleaf

holland@matt.ksu.ksu.edu (Rich Holland) writes:

>sims@drake.mitre.org (Jim Sims) writes:

>> If I was gonna hack some system, I'd be sure the first thing I'd do to is
>>find the root's version of tripwire and change it to *always* spit out the
>>"don' worry, be happy message"....

>...but it may not be '/etc/tripwire' or something so obvious.  What if
>the admin put it in '/var/spool/mail/some-user' and changed the perms
>so that it's not executable (harder to find).  You gonna poke through 
>EVERY file on the system lookin' for it?  What're the chances you'll be
>detected before you do?  :-)

    You are right in pointing out that Tripwire is only as reliable
and secure as the database and Tripwire executable files.  Therefore,
putting these files on the local system where they can be tampered with
would be a bad idea.

    In the documentation for Tripwire, we suggest putting both the 
database and the Tripwire executable on a ``secure-server''.  For
instance, putting them on read-only media on a remote file-system
with the files accessed via read-only NFS would be prudent.

Gene
    
(genek@mentor.cc.purdue.edu)