Variables Tripwire - Historique des versions

Frank : /* Règles additionnelles */

2008-10-31T08:48:39Z

‎Règles additionnelles

Frank : /* Règles additionnelles */

2008-09-26T06:50:13Z

‎Règles additionnelles

Frank le 26 septembre 2008 à 06:49

2008-09-26T06:49:40Z

Frank le 26 septembre 2008 à 06:47

2008-09-26T06:47:08Z

Frank le 26 septembre 2008 à 06:46

2008-09-26T06:46:02Z

Frank le 26 septembre 2008 à 06:45

2008-09-26T06:45:12Z

Frank le 26 septembre 2008 à 06:44

2008-09-26T06:44:38Z

Frank le 25 septembre 2008 à 17:33

2008-09-25T17:33:21Z

Frank le 25 septembre 2008 à 12:33

2008-09-25T12:33:28Z

Frank le 25 septembre 2008 à 12:32

2008-09-25T12:32:45Z

@@ Ligne 58 : / Ligne 58 : @@
 == Règles additionnelles ==
- '''CWrulename'''
+'''CWrulename'''<br/>
-    The CWrulename attribute is used to associate a rule or set of rules with a specific name. In a report file, this name
+The CWrulename attribute is used to associate a rule or set of rules with a specific name. In a report file, this name will be associated with violations to the specified rule. This feature is useful if you want to track certain objects within a large Tripwire database. For instance, if you associate the rule name "watchme" with important files, you can sort through the Tripwire report using "watchme" as a sorting key.
- will be associated with violations to the specified rule. This feature is useful if you want to track certain objects within
+ Example: /etc -> +ug (rulename=watchme);
- a large Tripwire database. For instance, if you associate the rule name "watchme" with important files, you can sort through
+'''CWemailto'''
- the Tripwire report using "watchme" as a sorting key.
+The CWemailto attribute associates one or more email addresses with a rule or group of rules. When an integrity check is run with the --email-report option and a rule is violated, a report of that violation will be sent to the specified email address(es), using the report format specified by the CWEMAILREPORTLEVEL variable in the configuration file.
-    Example: /etc -> +ug (rulename=watchme);
+ Example: /etc -> +ug (emailto=admin@domain.com);
- '''CWemailto'''
+To specify multiple email addresses, include them as a quoted, semicolon-delimited list.
-    The CWemailto attribute associates one or more email addresses with a rule or group of rules. When an integrity check is
+ /etc -> +ug (emailto="admin@foo.com;admin2@foo.com");
- run with the --email-report option and a rule is violated, a report of that violation will be sent to the specified email
+'''CWseverity'''
- address(es), using the report format specified by the CWEMAILREPORTLEVEL variable in the configuration file.
+The CWseverity attribute associates a numeric severity level with a rule. When Tripwire is run in Integrity Checking mode, it is possible to specify that only rules exceeding a certain severity level are used. The default severity level is 0, and values can range from 0 to 1,000,000.
-    Example: /etc -> +ug (emailto=admin@domain.com);
+Example: /etc -> +ug (severity=50);
- To specify multiple email addresses, include them as a quoted, semicolon-delimited list.
+'''CWrecurse'''
-             /etc -> +ug (emailto="admin@foo.com;admin2@foo.com");
+The CWrecurse attribute specifies how a rule will scan directories. Valid values for CWrecurse are true, false, or a number from -1 to 1,000,000. If CWrecurse is set to true (or -1), tripwire will recursively scan the entire contents of the directory (both files and subdirectories). When CWrecurse is set to false (or 0), and the rule refers to a directory, Tripwire will scan the inode of the directory but none of the files or subdirectories contained therein. For positive CWrecurse value n, the rule will monitor all objects up to n levels below the start point. Stop points within the recursed directory still apply, and will prevent the specified file or directory from being scanned.

@@ Ligne 58 : / Ligne 58 : @@
 == Règles additionnelles ==
-  CWrulename
+  '''CWrulename'''
      The CWrulename attribute is used to associate a rule or set of rules with a specific name. In a report file, this name
   will be associated with violations to the specified rule. This feature is useful if you want to track certain objects within
@@ Ligne 64 : / Ligne 64 : @@
   the Tripwire report using "watchme" as a sorting key.
      Example: /etc -> +ug (rulename=watchme);
-  CWemailto
+  '''CWemailto'''
      The CWemailto attribute associates one or more email addresses with a rule or group of rules. When an integrity check is
   run with the --email-report option and a rule is violated, a report of that violation will be sent to the specified email
@@ Ligne 71 : / Ligne 71 : @@
   To specify multiple email addresses, include them as a quoted, semicolon-delimited list.
               /etc -> +ug (emailto="admin@foo.com;admin2@foo.com");
-  CWseverity
+  '''CWseverity'''
      The CWseverity attribute associates a numeric severity level with a rule. When Tripwire is run in Integrity Checking
   mode, it is possible to specify that only rules exceeding a certain severity level are used. The default severity level is
 , and values can range from 0 to 1,000,000.
      Example: /etc -> +ug (severity=50);
-  CWrecurse
+  '''CWrecurse'''
      The CWrecurse attribute specifies how a rule will scan directories. Valid values for CWrecurse are true, false, or a
   number from -1 to 1,000,000. If CWrecurse is set to true (or -1), tripwire will recursively scan the entire contents of the

@@ Ligne 29 : / Ligne 29 : @@
   N 	+pinugsamc123456789 Template is used to ignore nothing.
   E 	-pinugsamc123456789 Template is used to ignore everything.
-  > 	Used for files that will increase in size. An alarm is tripped when the file size is smaller than it previously was. Test dfe depassement de ligne de ligne de lmigen
+  > 	Used for files that will increase in size. An alarm is tripped when the file size is smaller than it previously was.
 '''ReadOnly''' is good for files that are widely available but are intended to be read-only.
@@ Ligne 59 : / Ligne 59 : @@
   CWrulename
- The CWrulename attribute is used to associate a rule or set of rules with a specific name. In a report file, this name will be associated with violations to the specified rule. This feature is useful if you want to track certain objects within a large Tripwire database. For instance, if you associate the rule name "watchme" with important files, you can sort through the Tripwire report using "watchme" as a sorting key.
+    The CWrulename attribute is used to associate a rule or set of rules with a specific name. In a report file, this name
- Example: /etc -> +ug (rulename=watchme);
+ will be associated with violations to the specified rule. This feature is useful if you want to track certain objects within
   CWemailto
-     The CWemailto attribute associates one or more email addresses with a rule or group of rules. When an integrity check is run with the --email-report option and a rule is violated, a report of that violation will be sent to the specified email address(es), using the report format specified by the CWEMAILREPORTLEVEL variable in the configuration file.
+     The CWemailto attribute associates one or more email addresses with a rule or group of rules. When an integrity check is
      Example: /etc -> +ug (emailto=admin@domain.com);
-  To specify multiple email addresses, include them as a quoted, semicolon-delimited list. /etc -> +ug (emailto="admin@foo.com;admin2@foo.com");
+  To specify multiple email addresses, include them as a quoted, semicolon-delimited list.
   CWseverity
-     The CWseverity attribute associates a numeric severity level with a rule. When Tripwire is run in Integrity Checking mode, it is possible to specify that only rules exceeding a certain severity level are used. The default severity level is 0, and values can range from 0 to 1,000,000.
+     The CWseverity attribute associates a numeric severity level with a rule. When Tripwire is run in Integrity Checking
      Example: /etc -> +ug (severity=50);
   CWrecurse
-     The CWrecurse attribute specifies how a rule will scan directories. Valid values for CWrecurse are true, false, or a number from -1 to 1,000,000. If CWrecurse is set to true (or -1), tripwire will recursively scan the entire contents of the directory (both files and subdirectories). When CWrecurse is set to false (or 0), and the rule refers to a directory, Tripwire will scan the inode of the directory but none of the files or subdirectories contained therein. For positive CWrecurse value n, the rule will monitor all objects up to n levels below the start point. Stop points within the recursed directory still apply, and will prevent the specified file or directory from being scanned.
+     The CWrecurse attribute specifies how a rule will scan directories. Valid values for CWrecurse are true, false, or a

@@ Ligne 29 : / Ligne 29 : @@
   N 	+pinugsamc123456789 Template is used to ignore nothing.
   E 	-pinugsamc123456789 Template is used to ignore everything.
-  > 	Used for files that will increase in size. An alarm is tripped when the file size is smaller than it previously was.
+  > 	Used for files that will increase in size. An alarm is tripped when the file size is smaller than it previously was. Test dfe depassement de ligne de ligne de lmigen
 '''ReadOnly''' is good for files that are widely available but are intended to be read-only.

@@ Ligne 59 : / Ligne 59 : @@
   CWrulename
-    The CWrulename attribute is used to associate a rule or set of rules with a specific name. In a report file, this name will be associated with violations to the specified rule. This feature is useful if you want to track certain objects within a large Tripwire database. For instance, if you associate the rule name "watchme" with important files, you can sort through the Tripwire report using "watchme" as a sorting key.
+ The CWrulename attribute is used to associate a rule or set of rules with a specific name. In a report file, this name will be associated with violations to the specified rule. This feature is useful if you want to track certain objects within a large Tripwire database. For instance, if you associate the rule name "watchme" with important files, you can sort through the Tripwire report using "watchme" as a sorting key.
-    Example: /etc -> +ug (rulename=watchme);
+ Example: /etc -> +ug (rulename=watchme);
   CWemailto
      The CWemailto attribute associates one or more email addresses with a rule or group of rules. When an integrity check is run with the --email-report option and a rule is violated, a report of that violation will be sent to the specified email address(es), using the report format specified by the CWEMAILREPORTLEVEL variable in the configuration file.

← Version précédente		Version du 26 septembre 2008 à 06:44
Ligne 54 :		Ligne 54 :

	Value: +pinugtsdrbamcCMSH-l		Value: +pinugtsdrbamcCMSH-l
		+
		+	Règles additionnelles
		+	CWrulename
		+	The CWrulename attribute is used to associate a rule or set of rules with a specific name. In a report file, this name will be associated with violations to the specified rule. This feature is useful if you want to track certain objects within a large Tripwire database. For instance, if you associate the rule name "watchme" with important files, you can sort through the Tripwire report using "watchme" as a sorting key.
		+	Example: /etc -> +ug (rulename=watchme);
		+	CWemailto
		+	The CWemailto attribute associates one or more email addresses with a rule or group of rules. When an integrity check is run with the --email-report option and a rule is violated, a report of that violation will be sent to the specified email address(es), using the report format specified by the CWEMAILREPORTLEVEL variable in the configuration file.
		+	Example: /etc -> +ug (emailto=admin@domain.com);
		+	To specify multiple email addresses, include them as a quoted, semicolon-delimited list. /etc -> +ug (emailto="admin@foo.com;admin2@foo.com");
		+	CWseverity
		+	The CWseverity attribute associates a numeric severity level with a rule. When Tripwire is run in Integrity Checking mode, it is possible to specify that only rules exceeding a certain severity level are used. The default severity level is 0, and values can range from 0 to 1,000,000.
		+	Example: /etc -> +ug (severity=50);
		+	CWrecurse
		+	The CWrecurse attribute specifies how a rule will scan directories. Valid values for CWrecurse are true, false, or a number from -1 to 1,000,000. If CWrecurse is set to true (or -1), tripwire will recursively scan the entire contents of the directory (both files and subdirectories). When CWrecurse is set to false (or 0), and the rule refers to a directory, Tripwire will scan the inode of the directory but none of the files or subdirectories contained therein. For positive CWrecurse value n, the rule will monitor all objects up to n levels below the start point. Stop points within the recursed directory still apply, and will prevent the specified file or directory from being scanned.

@@ Ligne 21 : / Ligne 21 : @@
      M     MD5 hash value
      S     SHA hash value
 '''ReadOnly''' is good for files that are widely available but are intended to be read-only.

@@ Ligne 22 : / Ligne 22 : @@
      S     SHA hash value
-ReadOnly is good for files that are widely available but are intended to be read-only.
+'''ReadOnly''' is good for files that are widely available but are intended to be read-only.
 Value: +pinugtsdbmCM-rlacSH
-Dynamic
+'''Dynamic''' is good for monitoring user directories and files that tend to be dynamic in behavior.
 Value: +pinugtd-srlbamcCMSH
-Growing
+The '''Growing''' variable is intended for files that should only get larger.
 Value: +pinugtdl-srbamcCMSH
-Device
+'''Device''' is good for devices or other files that Tripwire should not attempt to open.
 Value: +pugsdr-intlbamcCMSH
-IgnoreAll
+'''IgnoreAll''' tracks a file's presence or absence, but doesn't check any other properties.
 Value: -pinugtsdrlbamcCMSH
-IgnoreNone
+'''IgnoreNone''' turns on all properties and provides a convenient starting point for defining your own property masks. (For example, mymask = $(IgnoreNone) -ar;)
 Value: +pinugtsdrbamcCMSH-l

@@ Ligne 1 : / Ligne 1 : @@
 Characters used in property masks, with descriptions:
      -      Ignore the following properties
      +     Record and check the following properties
@@ Ligne 22 : / Ligne 21 : @@
      M     MD5 hash value
      S     SHA hash value
 ReadOnly is good for files that are widely available but are intended to be read-only.