There are times where you want to update the tripwire policy after a system update. This section guides you on how to update the policy file (tw.pol
).
The first step is to regenerate the policy file. you can execute the following:
$ twadmin --print-polfile > twpol.txt
This regenerate the txpol.txt
for your use.
Once done, you may update your policy file accordingly in the re-generated twpol.txt
.
Upon completions, you may now regenerate the policy file and database.
The first thing you need to do is to delete the database and policy file. This can be done using root account by:
$ rm /etc/tripwire/tw.pol
$ rm /var/lib/tripwire/<hostname>.twd
Once done, you can re-sign the twpol.txt
file inside /etc/tripwire
.
$ cd /etc/tripwire
$ twadmin --create-polfile --cfgfile tw.cfg --site-keyfile site.key twpol.txt
with tw.pol
ready, you can reinitialize the database. This is done by:
$ tripwire --init
With the new database ready, you can double check its function:
$ tripwire --check --email-report
Lastly, you can remove the plaintext policy file.
$ rm twpol.txt
That's all for updating tripwire policy file.