|  | @@ -52,23 +52,47 @@ function install_tripwire {
 | 
	
		
			
			| 52 | 52 |      if [[ $(is_completed $FUNCNAME) == "1" ]]; then
 | 
	
		
			
			| 53 | 53 |          return
 | 
	
		
			
			| 54 | 54 |      fi
 | 
	
		
			
			|  | 55 | +
 | 
	
		
			
			|  | 56 | +    echo '*** Installing intrusion detection ***'
 | 
	
		
			
			|  | 57 | +
 | 
	
		
			
			|  | 58 | +    debconf-set-selections <<< "tripwire tripwire/use-sitekey boolean false"
 | 
	
		
			
			|  | 59 | +    debconf-set-selections <<< "tripwire tripwire/use-localkey boolean false"
 | 
	
		
			
			|  | 60 | +
 | 
	
		
			
			| 55 | 61 |      apt-get -yq install tripwire
 | 
	
		
			
			| 56 | 62 |      apt-get -yq autoremove
 | 
	
		
			
			| 57 | 63 |      cd /etc/tripwire
 | 
	
		
			
			| 58 |  | -    cp site.key $DEFAULT_DOMAIN_NAME-site.key
 | 
	
		
			
			| 59 |  | -    echo '*** Installing intrusion detection ***'
 | 
	
		
			
			|  | 64 | +
 | 
	
		
			
			|  | 65 | +    echo 'ROOT          =/usr/sbin' > /etc/tripwire/twcfg.txt
 | 
	
		
			
			|  | 66 | +    echo 'POLFILE       =/etc/tripwire/tw.pol' >> /etc/tripwire/twcfg.txt
 | 
	
		
			
			|  | 67 | +    echo 'DBFILE        =/var/lib/tripwire/$(HOSTNAME).twd' >> /etc/tripwire/twcfg.txt
 | 
	
		
			
			|  | 68 | +    echo 'REPORTFILE    =/var/lib/tripwire/report/$(HOSTNAME)-$(DATE).twr' >> /etc/tripwire/twcfg.txt
 | 
	
		
			
			|  | 69 | +    echo 'SITEKEYFILE   =/etc/tripwire/$(HOSTNAME)-site.key' >> /etc/tripwire/twcfg.txt
 | 
	
		
			
			|  | 70 | +    echo 'LOCALKEYFILE  =/etc/tripwire/$(HOSTNAME)-local.key' >> /etc/tripwire/twcfg.txt
 | 
	
		
			
			|  | 71 | +    echo 'EDITOR        =/usr/bin/editor' >> /etc/tripwire/twcfg.txt
 | 
	
		
			
			|  | 72 | +    echo 'LATEPROMPTING =false' >> /etc/tripwire/twcfg.txt
 | 
	
		
			
			|  | 73 | +    echo 'LOOSEDIRECTORYCHECKING =false' >> /etc/tripwire/twcfg.txt
 | 
	
		
			
			|  | 74 | +    echo 'MAILNOVIOLATIONS =false' >> /etc/tripwire/twcfg.txt
 | 
	
		
			
			|  | 75 | +    echo 'EMAILREPORTLEVEL =3' >> /etc/tripwire/twcfg.txt
 | 
	
		
			
			|  | 76 | +    echo 'REPORTLEVEL   =3' >> /etc/tripwire/twcfg.txt
 | 
	
		
			
			|  | 77 | +    echo 'SYSLOGREPORTING =false' >> /etc/tripwire/twcfg.txt
 | 
	
		
			
			|  | 78 | +    echo 'MAILMETHOD    =SMTP' >> /etc/tripwire/twcfg.txt
 | 
	
		
			
			|  | 79 | +    echo 'SMTPHOST      =localhost' >> /etc/tripwire/twcfg.txt
 | 
	
		
			
			|  | 80 | +    echo 'SMTPPORT      =25' >> /etc/tripwire/twcfg.txt
 | 
	
		
			
			|  | 81 | +    echo 'TEMPDIRECTORY =/tmp' >> /etc/tripwire/twcfg.txt
 | 
	
		
			
			|  | 82 | +
 | 
	
		
			
			|  | 83 | +    echo '
 | 
	
		
			
			|  | 84 | +
 | 
	
		
			
			|  | 85 | +       ' | twadmin --generate-keys -L /etc/tripwire/${HOSTNAME}-local.key -S /etc/tripwire/${HOSTNAME}-site.key
 | 
	
		
			
			|  | 86 | +
 | 
	
		
			
			| 60 | 87 |      echo '
 | 
	
		
			
			| 61 | 88 |  
 | 
	
		
			
			| 62 |  | -' | tripwire --init
 | 
	
		
			
			|  | 89 | +       ' | twadmin --create-cfgfile -S /etc/tripwire/${HOSTNAME}-site.key /etc/tripwire/twcfg.txt
 | 
	
		
			
			| 63 | 90 |  
 | 
	
		
			
			| 64 | 91 |      # make a script for easy resetting of the tripwire
 | 
	
		
			
			| 65 | 92 |      echo '#!/bin/sh' > /usr/bin/reset-tripwire
 | 
	
		
			
			| 66 | 93 |      echo 'tripwire --update-policy --secure-mode low /etc/tripwire/twpol.txt' >> /usr/bin/reset-tripwire
 | 
	
		
			
			| 67 | 94 |      chmod +x /usr/bin/reset-tripwire
 | 
	
		
			
			| 68 | 95 |  
 | 
	
		
			
			| 69 |  | -    sed -i 's/SYSLOGREPORTING.*/SYSLOGREPORTING =false/g' /etc/tripwire/twcfg.txt
 | 
	
		
			
			| 70 |  | -    # only send emails if something has changed
 | 
	
		
			
			| 71 |  | -    sed -i 's|MAILNOVIOLATIONS.*|MAILNOVIOLATIONS = false|g' /etc/tripwire/twcfg.txt
 | 
	
		
			
			| 72 | 96 |      sed -i '/# These files change the behavior of the root account/,/}/ s/.*//g' /etc/tripwire/twpol.txt
 | 
	
		
			
			| 73 | 97 |      sed -i 's|/etc/rc.boot.*||g' /etc/tripwire/twpol.txt
 | 
	
		
			
			| 74 | 98 |      # Don't show any changes to /proc
 | 
	
	
		
			
			|  | @@ -91,11 +115,20 @@ function install_tripwire {
 | 
	
		
			
			| 91 | 115 |      fi
 | 
	
		
			
			| 92 | 116 |      # Avoid logging the changed database
 | 
	
		
			
			| 93 | 117 |      sed -i 's|$(TWETC)/tw.pol.*||g' /etc/tripwire/twpol.txt
 | 
	
		
			
			| 94 |  | -    # recreate the configuration
 | 
	
		
			
			|  | 118 | +    # create the policy
 | 
	
		
			
			|  | 119 | +    echo '
 | 
	
		
			
			|  | 120 | +
 | 
	
		
			
			|  | 121 | +       ' | twadmin --create-polfile -S /etc/tripwire/${HOSTNAME}-site.key /etc/tripwire/twpol.txt
 | 
	
		
			
			|  | 122 | +
 | 
	
		
			
			|  | 123 | +    # create the database
 | 
	
		
			
			| 95 | 124 |      echo '
 | 
	
		
			
			| 96 | 125 |  
 | 
	
		
			
			| 97 |  | -       ' | twadmin --create-cfgfile -S /etc/tripwire/site.key /etc/tripwire/twcfg.txt
 | 
	
		
			
			| 98 |  | -    # reset
 | 
	
		
			
			|  | 126 | +' | tripwire --init --cfgfile /etc/tripwire/tw.cfg --polfile /etc/tripwire/tw.pol --dbfile /var/lib/tripwire/${HOSTNAME}.twd
 | 
	
		
			
			|  | 127 | +    if [ ! -f /var/lib/tripwire/$(HOSTNAME).twd ]; then
 | 
	
		
			
			|  | 128 | +        echo $'tripwire database was not created'
 | 
	
		
			
			|  | 129 | +        exit 72925
 | 
	
		
			
			|  | 130 | +    fi
 | 
	
		
			
			|  | 131 | +    # recreate the configuration
 | 
	
		
			
			| 99 | 132 |      echo '
 | 
	
		
			
			| 100 | 133 |  
 | 
	
		
			
			| 101 | 134 |  
 |