--- Tripwire ---

01 cat /etc/redhat-release 

02 -- install 6
   rpm -ivh http://dl.fedoraproject.org/pub/epel/6/x86_64/Packages/t/tripwire-2.4.3.5-1.el6.x86_64.rpm

   -- install 7
   rpm -ivh http://dl.fedoraproject.org/pub/epel/7/x86_64/Packages/t/tripwire-2.4.3.5-1.el7.x86_64.rpm

03 -- update policy file
   -- cd /etc/tripwire
   -- \rm twpol.txt
   -- wget http://centosone.binghamton.edu/Upload/twpol.txt
   -- USE THIS IF: RHEL7 ....
   -- wget http://centosone.binghamton.edu/Upload/twpol-07.txt;mv twpol-07.txt twpol.txt
   -- wget http://centosone.binghamton.edu/Upload/FixHostHame.sh
   -- sh FixHostHame.sh; grep HOSTNAME twpol.txt
  
   rulename = "Tripwire Binaries", 
   severity = $(SIG_HI), 
   emailto = "esitp@binghamton.edu"
  
   rulename = "Tripwire Data Files",
   severity = $(SIG_HI),
   emailto = "esitp@binghamton.edu"
    
04 -- generate site keys
  /usr/sbin/tripwire-setup-keyfiles
  Enter the site keyfile passphrase:  AsTheWorldTurns2018
  Enter the local keyfile passphrase: Guiding2018LightOp

05 -- initialize database
   tripwire --init

06 -- check database and update if needed
   tripwire --check --interactive

07 -- update policy file (apply all changes first)
   tripwire --update-policy /etc/tripwire/twpol.txt

08 -- print the text policy and config files
   twadmin --print-polfile > /etc/tripwire/twpol.txt
   twadmin --print-cfgfile > /etc/tripwire/twcfg.txt


09 -- recreate signed policy and config file
   twadmin --create-cfgfile -S /etc/tripwire/site.key /etc/tripwire/twcfg.txt
   twadmin --create-polfile -S /etc/tripwire/site.key /etc/tripwire/twpol.txt
   tripwire --init

10 -- run report
   ls -l /var/lib/tripwire/report/
   /usr/sbin/twprint -m r --twrfile /var/lib/tripwire/report/<`ls -l /var/lib/tripwire/report/`>.twr > tripwire-report.txt
   /usr/sbin/twprint -m d --print-dbfile /etc/hosts

11 - backup and remove
mkdir /usr/local/src/.tripwire
cp -p /var/lib/tripwire/*.twd /usr/local/src/.tripwire
cp -p /etc/tripwire/*.key /usr/local/src/.tripwire
cp -p /etc/tripwire/twpol.* /etc/tripwire/twcfg.* /usr/local/src/.tripwire
rm -rf /etc/tripwire/twpol.* /etc/tripwire/twcfg.*

-----------------------------------------------------------
12 -- another way to update policy file
   /usr/sbin/tripwire --update --twrfile /var/lib/tripwire/report/baninbt-20180105-151853.twr

13 - Create the crontab file
   vi  /usr/local/bin/CkWithTripwire.sh
       #!/bin/sh
       /usr/sbin/tripwire --check >/tmp/.tw.$$
       /bin/mailx -s "TWReport ${HOSTNAME}  `date`"  chouck@binghamton.edu < /tmp/.tw.$$

   chmod 700 /usr/local/bin/CkWithTripwire.sh

   /usr/local/bin/CkWithTripwire.sh

Note:
=====================================================================================================================
-- recreate the tw.txt
   /usr/sbin/twadmin --create-cfgfile -S site.key /etc/tripwire/twcfg.txt

-- recreate the tw.pol
   /usr/sbin/twadmin --create-polfile -S site.key /etc/tripwire/twpol.txt


My Notes:
=====================================================================================================================
 UPDATE POLICY FILE
The configuration is simply done in the /etc/tripwire/twpol.txt file and after any changes in must be re-encoded :
twadmin -m P /etc/tripwire/twpol.txt
Which may require a re-creation of the database:
tripwire --init

SECURITY CLEAN UP
The configuration file can be deleted to prevent an intruder from knowing which files have been changed,:
rm /etc/tripwire/twcfg.txt /etc/tripwire/twpol.txt

RECREATE POLICY AND CONFIGURATION FILES
To re-create the .txt files:
twadmin -m p > /etc/tripwire/twpol1.txt
twadmin -m f > /etc/tripwire/twcfg.txt

UPDATE DATABASE
After installing new s/w or other changes to files the database will need to be updated. This will run a check and create a file to be changed (if you wish) and then used by tripwire to chage the db;
tripwire -m c --interactive

CHECK SYSTEM To check the integrity of the file system we type the instruction:
tripwire -m c