Tripwire Setup

tripwire-setup.sh

cd /etc/tripwire/

# setup
tripwire-setup-keyfiles
tripwire --init

# remove 404s
tripwire --check | grep Filename | sed 's/     Filename: \(.*\)/\1/' > twpol.sh
sed -i 's/\//\\\//g' twpol.sh
sed -i 's/\./\\\./g' twpol.sh
sed -i "s/^/sed -i '\//g" twpol.sh
sed -i "s/$/\/d' twpol.tsh/g" twpol.txt
chmod u+x twpol.sh
./twpol.sh

# remove /var/log
sed -e '/     \/var\/log/ s/^#*/#/' -i twpol.txt

# resetup
twadmin -m P twpol.txt
tripwire --init

# update twcfg
sed -i 's/^MAILNOVIOLATIONS       =true/MAILNOVIOLATIONS       =false/' twcfg.txt
sed -i 's/^EMAILREPORTLEVEL       =3/EMAILREPORTLEVEL       =1/' twcfg.txt
sed -i 's/^REPORTLEVEL            =3/REPORTLEVEL            =1/' twcfg.txt
twadmin --create-cfgfile -S site.key twcfg.txt

# cleanup
rm -f twpol.txt twcfg.txt twpol.sh