Tripwire 1.2

2010-04-12 Thread Doug Hardie
Has anyone successfully got Tripwire 1.2 to work on FreeBSD 8?  It compiles 
fine, but it trips on every file.  It decides that the atime has changed.  The 
report shows the observed and expected times are far different.  Often off by 
10s of years from what the file actually shows.  Even more interesting is that 
it trips on every file in /bin where the config file consists of only:

/binR-2

That should not even be checking the atime - but it does.  It does work fine on 
FreeBSD 7.2.  I have not been able to figure out why it would do this on 
8.0.___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: tripwire

2005-08-29 Thread James
On Friday 17 June 2005 05:39 am, Stephen P. Cravey wrote:
 I'm having trouble gettign tripwire to update the database. When I run:
 tripwire --update -v
 I get the following:

 Tripwire(R) 2.3.1.2 for BSD

 Tripwire 2.3 Portions copyright 2000 Tripwire, Inc. Tripwire is a
 registered trademark of Tripwire, Inc. This software comes with
 ABSOLUTELY NO WARRANTY; for details use --version. This is free software
 which may be redistributed or modified only under certain conditions;
 see COPYING for details. All rights reserved.
 Opening configuration file: /usr/local/etc/tripwire/tw.cfg
 This file is encrypted.

 Opening key file: /usr/local/etc/tripwire/site.key
 Opening key file: /usr/local/etc/tripwire/foo.bar.org-local.key
 Opening database file: /var/db/tripwire/foo.bar.org.twd
 This file is encrypted.
 Opening report file:
 /var/db/tripwire/report/foo.bar.org-20050617-073542.twr
 ### Error: File could not be opened.
 ### Filename:
 #/var/db/tripwire/report/foo.bar.org-20050617-073542.twr ## No such
 #file or directory ## Exiting...



 I have verified that the file:
 /var/db/tripwire/report/foo.bar.org-20050617-073542.twr
 can be written by root (duh), but i cannot figure out why I'm getting
 the error. Ideas?

 -Stephen

Hi,

I remeber getting such an error and it having to do with the date of creation 
in the file name. The day the database report was created and the day the 
update is run are different and the update is trying to find a report with 
the current date and not the date of creation.

You will find that using tripwire -m c -I will:

1) check the database
2) create the report for the current day
3) open the report in the editor specified in tw.cfg (default is vi)
4) allow you to adjust what you want updated in the database
5) update the database after you exit vi.

Upon exit you will be prompted for your local passphrase and then the updated 
database will be writen.

-james





___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: Tripwire Policy File and 5.4

2005-08-11 Thread Joel Hatton
Hi,

 I'm not so convinced of that - after a cvsup of ports overnight, this
 remains:
 
 # ll /usr/ports/security/tripwire/files/twpol.txt 
 -rw-r--r--  1 root  wheel  20651 Mar  5  2002 /usr/ports/security/tripwire/fi
 les/twpol.txt

Well, just to prove me wrong I updated ports again and:

# ll /usr/ports/security/tripwire/files/twpol.txt
-rw-r--r--  1 root  wheel  20891 Aug 10 17:46 
/usr/ports/security/tripwire/files/twpol.txt

I've updated, but unfortunately my two main complaints - that of not being
about to package it, and no interactive updates - remain.

cheers,
-- Joel Hatton --
Security Analyst| Hotline: +61 7 3365 4417
AusCERT - Australia's national CERT | Fax: +61 7 3365 7031
The University of Queensland| WWW: www.auscert.org.au
Qld 4072 Australia  | Email:   [EMAIL PROTECTED]
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Tripwire-2.3.1.2 problem on a FreeBSD 4.11 box

2005-08-11 Thread Gary Hayers

Hi list users,

I am having some problems installing Tripwire-2.3.1.2 from the ports 
collection on a FreeBSD 4.11 machine, I get an error when I issue the 
make command:


===  Vulnerability check disabled, database not found
===  Extracting for tripwire-2.3.1.2_5
= Checksum mismatch for tripwire-2.3.1-2.tar.gz.
===  Refetch for 1 more times files: tripwire-2.3.1-2.tar.gz
===  Vulnerability check disabled, database not found
= tripwire-2.3.1-2.tar.gz doesn't seem to exist in /usr/ports/distfiles/.
= Attempting to fetch from 
http://heanet.dl.sourceforge.net/sourceforge/tripwire/.

tripwire-2.3.1-2.tar.gz   100% of 1479 kB  197 kBps
===  Vulnerability check disabled, database not found
= Checksum OK for tripwire-2.3.1-2.tar.gz.
===  Patching for tripwire-2.3.1.2_5
===  Applying FreeBSD patches for tripwire-2.3.1.2_5
===   tripwire-2.3.1.2_5 depends on executable: gmake - found
===  Configuring for tripwire-2.3.1.2_5
===  Building for tripwire-2.3.1.2_5
echo \MAKE RELEASE\  release.i386-unknown-freebsd.out
date  release.i386-unknown-freebsd.out
echo \gmake -f Makefile  twprint_r  twadmin_r  siggen_r  tripwire_r 
 | tee -a release.i386-unknown-freebsd.out\  
release.i386-unknown-freebsd.out
gmake -f Makefile  twprint_r  twadmin_r  siggen_r  tripwire_r| tee 
-a release.i386-unknown-freebsd.out
gmake[1]: Entering directory 
`/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src'

gmake -C STLport-4.0 -f STLport.mak release SYSPRE=i386-unknown-freebsd
gmake[2]: Entering directory 
`/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src/STLport-4.0'

test -d ../../lib || mkdir ../../lib
test -d ../../lib/i386-unknown-freebsd_r || mkdir 
../../lib/i386-unknown-freebsd_r
test -e include || test xi386-unknown-freebsd != 
xi386-unknown-freebsd || ln -s 
/usr/local/lib/gcc-lib/i386-portbld-freebsd4.11/2.95.3/include include
test -e include || test xi386-unknown-freebsd != 
xi386-unknown-openbsd || ln -s 
/usr/local/lib/gcc-lib/i386-portbld-freebsd4.11/2.95.3/include include
export 
PATH=./stlport:/sbin:/bin:/usr/sbin:/usr/bin:/usr/games:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin:/root/bin:/root/bin:/usr/local/etc/rc.d; 
gmake -C ./src -f gcc.mak clobber
gmake[3]: Entering directory 
`/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src/STLport-4.0/src'

rm -rf obj/GCCi386/Release obj/GCCi386/Debug \
obj/GCCi386/DebugSTL obj/GCCi386/ReleaseD \
obj/GCCi386/DebugD obj/GCCi386/DebugSTLD SunWS_cache 
Templates.DB tempinc

rm -rf obj
rm -rf ../lib/libstlport_gcc_debug.* \
   ../lib/libstlport_gcc.* ../lib/libstlport_gcc_stldebug.*
gmake[3]: Leaving directory 
`/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src/STLport-4.0/src'

gmake -f STLport.mak lib/libstlport_gcc.a
gmake[3]: Entering directory 
`/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src/STLport-4.0'
export 
PATH=./stlport:/sbin:/bin:/usr/sbin:/usr/bin:/usr/games:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin:/root/bin:/root/bin:/usr/local/etc/rc.d; 
gmake -C ./src -f gcc.mak ../lib/libstlport_gcc.a
gmake[4]: Entering directory 
`/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src/STLport-4.0/src'

mkdir -p ../lib
mkdir -p obj/GCCi386/Release
g++295 -I../stlport -Wall -W -Wno-sign-compare -Wno-unused 
-Wno-uninitialized -ftemplate-depth-32 -O2 complex.cpp -c -o 
obj/GCCi386/Release/complex.o

gmake[4]: g++295: Command not found
gmake[4]: *** [obj/GCCi386/Release/complex.o] Error 127
gmake[4]: Leaving directory 
`/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src/STLport-4.0/src'

gmake[3]: *** [lib/libstlport_gcc.a] Error 2
gmake[3]: Leaving directory 
`/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src/STLport-4.0'

gmake[2]: *** [../../lib/i386-unknown-freebsd_r/libstlport_gcc.a] Error 2
gmake[2]: Leaving directory 
`/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src/STLport-4.0'

gmake[1]: *** [STLport_r] Error 2
gmake[1]: Leaving directory 
`/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src'

date  release.i386-unknown-freebsd.out

And I also get an error on a make install command:

Please type accept to indicate your acceptance of this
license agreement. [do not accept] accept
Using configuration file install.cfg

Checking for programs specified in install configuration file

/usr/sbin/sendmail exists.  Continuing installation.

/usr/bin/vi exists.  Continuing installation.


--
Verifying existence of binaries...

./bin/i386-unknown-freebsd_r/siggen missing.  Build did not complete 
successfully.

*** Error code 1

Stop in /usr/ports/security/tripwire.

If anybody has an idea on why I get this failure I'd be glad if you 
could share a solution with me.


Many Thanks

--

Gary Hayers
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: Tripwire Policy File and 5.4

2005-08-09 Thread Bret Walker
FYI-

The policy file looks to be updated for 5.x systems now.  Tripwire's back.

Bret

Bret Walker wrote:
 Does anyone know where I can find a good Tripwire policy file for 5.4?
 
 I installed tripwire-2.3.1.2_3 from ports, but the default policy file
 throws a lot of errors.  I think it's tailored to 4.x.
 
 Thanks,
 Bret

-- 
Bret Walker

Technical Support Consultant
Medill School of Journalism
Northwestern University
847-467-7845
847-491-2370 fax
[EMAIL PROTECTED]
http://www.it.medill.northwestern.edu/


smime.p7s
Description: S/MIME Cryptographic Signature


Re: Tripwire Policy File and 5.4

2005-08-09 Thread Joel Hatton
 
 The policy file looks to be updated for 5.x systems now.  Tripwire's back.

I'm not so convinced of that - after a cvsup of ports overnight, this
remains:

# ll /usr/ports/security/tripwire/files/twpol.txt 
-rw-r--r--  1 root  wheel  20651 Mar  5  2002 
/usr/ports/security/tripwire/files/twpol.txt

Last time I tried, Tripwire was still unable to perform an interactive
update, which is no great inconvenience but doesn't really inspire
confidence. The only improvement I've noticed since the first 5.x is that
it at least compiles now - given the lack of effective replacements for
Tripwire this is the least we could expect. Not being able to package this
port has been a real trial, however, and I don't believe that it wouldn't
be possible with a bit of consideration - no, I'm not volunteering right
now as more important things are pressing me.

I have adapted my own policy/config file and periodic script to run with
output in the daily security email - I'm happy to post these if anyone is
interested.

cheers,
joel

-- Joel Hatton --
Security Analyst| Hotline: +61 7 3365 4417
AusCERT - Australia's national CERT | Fax: +61 7 3365 7031
The University of Queensland| WWW: www.auscert.org.au
Qld 4072 Australia  | Email:   [EMAIL PROTECTED]
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Tripwire Policy File and 5.4

2005-08-04 Thread Bret Walker
Does anyone know where I can find a good Tripwire policy file for 5.4?

I installed tripwire-2.3.1.2_3 from ports, but the default policy file
throws a lot of errors.  I think it's tailored to 4.x.

Thanks,
Bret


smime.p7s
Description: S/MIME Cryptographic Signature


tripwire

2005-06-17 Thread Stephen P. Cravey
I'm having trouble gettign tripwire to update the database. When I run:
tripwire --update -v
I get the following:

Tripwire(R) 2.3.1.2 for BSD

Tripwire 2.3 Portions copyright 2000 Tripwire, Inc. Tripwire is a
registered trademark of Tripwire, Inc. This software comes with
ABSOLUTELY NO WARRANTY; for details use --version. This is free software
which may be redistributed or modified only under certain conditions;
see COPYING for details. All rights reserved.
Opening configuration file: /usr/local/etc/tripwire/tw.cfg
This file is encrypted.

Opening key file: /usr/local/etc/tripwire/site.key
Opening key file: /usr/local/etc/tripwire/foo.bar.org-local.key
Opening database file: /var/db/tripwire/foo.bar.org.twd
This file is encrypted.
Opening report file:
/var/db/tripwire/report/foo.bar.org-20050617-073542.twr
### Error: File could not be opened.
### Filename:
#/var/db/tripwire/report/foo.bar.org-20050617-073542.twr ## No such
#file or directory ## Exiting...



I have verified that the file:
/var/db/tripwire/report/foo.bar.org-20050617-073542.twr
can be written by root (duh), but i cannot figure out why I'm getting
the error. Ideas?

-Stephen
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


tripwire in 5.4

2005-05-13 Thread Tim Traver
Hi all,
seems that tripwire is not updated to run 5.4...
Are there any plans to have the port updated ?
Is it possible to compile it anyways ???
Thanks,
Tim.
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: tripwire in 5.4

2005-05-13 Thread Lowell Gilbert
Tim Traver [EMAIL PROTECTED] writes:

 seems that tripwire is not updated to run 5.4...
 
 Are there any plans to have the port updated ?

Sure.  Those plans came to fruition a month ago.

Update your ports, and the tripwire port should build.
It requires an old gcc version, though, so you'll have to be pretty
patient while it builds the compiler first...
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: tripwire on 5.2.1

2004-06-27 Thread Remko Lodder
Hi Dave,
dave wrote:
Hello,
A while back i tried installing the tripwire port, but it reported as
broken. I was wondering is anyone using this on 5.2.1?
Thanks.
Dave.
Well, i am not going to answer your question since i dont run tripwire...
What i do run is AIDE, which does the same (keeps checksums of files in 
a db and checks them)..
I don't know if you want to run it, but here it is

/usr/ports/security/aide
Cheers
--
Kind regards,
Remko Lodder   |[EMAIL PROTECTED]
Reporter DSINet|[EMAIL PROTECTED]
Projectleader Mostly-Harmless  |[EMAIL PROTECTED]
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: tripwire on 5.2.1

2004-06-27 Thread User LAFFER1
I was able to get a really old version in ports to work, but not the most 
recent build.  The old version occasionally crashed on me when running a 
check on the filesystem.  I would look at some of the alternatives to 
tripwire in ports for a 5.x system.

On Sun, 27 Jun 2004, dave wrote:
Hello,
A while back i tried installing the tripwire port, but it reported as
broken. I was wondering is anyone using this on 5.2.1?
Thanks.
Dave.
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


tripwire on 5.2.1

2004-06-26 Thread dave
Hello,
A while back i tried installing the tripwire port, but it reported as
broken. I was wondering is anyone using this on 5.2.1?
Thanks.
Dave.

___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


aide/tripwire/yafic freebsd 5x

2004-03-09 Thread re re
hi all

on my freebsd 5x machines i've been using yafic as an intrusion detection utility.  it 
doesn't support as many algorithms as 
aide or tripwire.  the reason i don't use tripwire is because the 2.3x version of the 
port is marked as broken on freebsd 5x.  
yesterday i tried to install yafic from ports - i tried running it once and got the 
'not implemented in db_readline_file 311' error - 
which, from the aide mailing lists is a bug that is fixed in the current cvs version, 
but apparently has not yet made it to freebsd 
ports.

is there anyone out there using either aide or tripwire on freebsd 5x?  if there's a 
way to get either of these working on 
freebsd5x, it would be nice.

thanks again
-- 
__
Check out the latest SMS services @ http://www.linuxmail.org 
This allows you to send and receive SMS through your mailbox.


Powered by Outblaze
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Tripwire question

2004-03-09 Thread Darryl Hoar
I have Freebsd 5.1 installed.
I want to install tripwire for intrusion detection.
Is there a location that has the basic policy
file for Freebsd 5.1 ?  This would sure save a 
boat load of typing.

thanks,
Darryl
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: Tripwire question

2004-03-09 Thread Rob Ellis
On Tue, Mar 09, 2004 at 04:18:00PM -0600, Darryl Hoar wrote:
 I have Freebsd 5.1 installed.
 I want to install tripwire for intrusion detection.
 Is there a location that has the basic policy
 file for Freebsd 5.1 ?  This would sure save a 
 boat load of typing.

'aide' is a replacement and extension for Tripwire --
see /usr/ports/security/aide. it comes with an 'aide.conf.freebsd' 
config which uses the same (similar?) syntax as tripwire...

- rob
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: Tripwire question

2004-03-09 Thread Alex de Kruijff
On Tue, Mar 09, 2004 at 04:18:00PM -0600, Darryl Hoar wrote:
 I have Freebsd 5.1 installed.
 I want to install tripwire for intrusion detection.
 Is there a location that has the basic policy
 file for Freebsd 5.1 ?  This would sure save a 
 boat load of typing.

That comes install with the port. Its posible that some tripwire ports
are broken. You can compile 12 (I think this one does work) or install
the package.


-- 
Alex

Articles based on solutions that I use:
http://www.kruijff.org/alex/index.php?dir=docs/FreeBSD/
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


tripwire

2004-02-22 Thread Lucas Holt
Can someone recommend a program like tripwire for 5.2.1-RC2 FreeBSD?

i was using tripwire in 4.x but the port is broken in 5.x.

Lucas Holt
[EMAIL PROTECTED]

FoolishGames.com  (Jewel Fan Site)
JustJournal.com (Free blogging)
'I try to think but nothing happens'
-- Homer Jay Simpson
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: tripwire

2004-02-22 Thread jan . muenther
 Can someone recommend a program like tripwire for 5.2.1-RC2 FreeBSD?

Tried this one here?

Port:   aide-0.9
Path:   /usr/ports/security/aide
Info:   A replacement and extension for Tripwire

___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: mtree vs tripwire

2004-01-21 Thread Lowell Gilbert
Tillman Hodgson [EMAIL PROTECTED] writes:

 On Tue, Jan 20, 2004 at 07:53:44PM -0500, Lowell Gilbert wrote:
  Tillman Hodgson [EMAIL PROTECTED] writes:
   On Tue, Jan 20, 2004 at 07:40:28PM -0500, Lowell Gilbert wrote:
Hmm.  I've never had this problem, and when I try to trigger it
deliberately, I find that my mtree specification has the spaces in the
filenames escaped.

e.g.,
foo\040bar\040baz \
   
   Interesting. I'm using -STABLE as of Jan 7/04 on this box ... is your
   mtree by any chance from -CURRENT?
  
  No, it's -STABLE within the last few days.
  
  Any chance you could generate a test case that demonstrates the
  problem on your system?
 
 I tried `touch`ing files to create them with spaces, and they ended up
 encoded as follows:
 
 # ./test
 /set type=file uid=0 gid=0 mode=0644 nlink=1 flags=none
 testtype=dir mode=0755 nlink=2 size=512 time=1074647709.0
 this\040is\040a\040file\040with\040spaces.txt \
 size=0 time=1074647708.0 \
 sha1digest=da39a3ee5e6b4b0d3255bfef95601890afd80709
 # ./test
 
 But when I try to mtree a directory that includes Loki SimCity 3000
 saved games I get files with spaces unencoded:
 
 # mtree -K sha1digest -c -X mtree.exclude -p /exports/tillman/.loki/sc3u/  mtree.out
 
 # ./buildings
 /set type=file uid=500 gid=500 mode=0777 nlink=1 flags=none
 buildings   type=dir mode=0755 nlink=2 size=1024 time=1017616936.0
 Den\040Burg\040Bruges.bld \
 type=link size=39 time=1017616936.0 \
 link=/opt/SC3U/buildings/Den Burg Bruges.bld
 Dupont\040House.bld \
 type=link size=36 time=1017616936.0 \
 link=/opt/SC3U/buildings/Dupont House.bld
 Garvey\040Plaza.bld \
 type=link size=36 time=1017616936.0 \
 link=/opt/SC3U/buildings/Garvey Plaza.bld
 GuestHouse\040Building.bld \
 type=link size=43 time=1017616936.0 \
 link=/opt/SC3U/buildings/GuestHouse Building.bld
 etc.
 
 The filesystem is still UFS2. I'm just NFS exporting my home
 directories to several machines, including the RedHat 7.3 box that
 originally generated the sc3u save files.
 
 I'm not /that/ worried about it: I should exclude home directories from
 mtree for this tripwire replacement purpose anyway. But it's worrisome
 that it /could/ fail in this way.

Unless we can establish what this way is, there isn't much we can do
about it.  It sounds like you've tried to create your test on the same
filesystem as the files that were showing the problems, so I'm not
sure what else to check.  Maybe you can see some differences in the
directory listings themselves?
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


removing tripwire reports

2003-10-31 Thread Noah



I have a need for a script that removes tripwire reports that are over 30 days
old.   my /var fills up quickly from them.   aany clue on how to write this?

- Noah


___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: removing tripwire reports

2003-10-31 Thread Mike Hogsett

Read find(1).  find is your friend.

 - Mike


 
 
 
 I have a need for a script that removes tripwire reports that are over 30 day
 s
 old.   my /var fills up quickly from them.   aany clue on how to write this?
 
 - Noah
 
 
 ___
 [EMAIL PROTECTED] mailing list
 http://lists.freebsd.org/mailman/listinfo/freebsd-questions
 To unsubscribe, send any mail to [EMAIL PROTECTED]
 
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: removing tripwire reports

2003-10-31 Thread Robert Huff

Mike Hogsett writes:

  Read find(1).  find is your friend.

Or possibly newsyslog.


Robert Huff


___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Tripwire Policy File

2003-08-08 Thread Stephen L Martin
Hello,

I'm trying to build a solid tripwire policy file. So far I have only found
one resource to use:

http://www.schlacter.net/public/FreeBSD-STABLE_and_IPFILTER.html

Though this seems to be a good one it is written for 4.6. I'm not sure if
this is a problem or not.

So my questions are: How much changed (file structurally) in 4.8, is this
4.6 o.k. to use?

Also if anyone else knows of any other resources to help me build this
that would be great.


-Stephen


___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: Tripwire

2003-07-15 Thread Karel J. Bosschaart
On Mon, Jul 14, 2003 at 11:07:58PM -0500, Neu, Benjamin S. wrote:
 This is the error I get when trying to install Tripwire in FreeBSD 5.1
 
 After doing a: make install  make clean 
 
 I get: Fails to build under 5.X
 
 What am I doing wrong?

You're doing nothing wrong, it's in the Makefile of the tripwire port:

.if ${OSVERSION} = 50
BROKEN= Fails to build under 5.X
.endif

So if you want to use tripwire in 5.1 it has to be fixed to compile.
I saw other versions of tripwire in the ports tree, maybe they work for
you?

Karel.
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Tripwire

2003-07-14 Thread Neu, Benjamin S.
This is the error I get when trying to install Tripwire in FreeBSD 5.1

After doing a: make install  make clean 

I get: Fails to build under 5.X

What am I doing wrong?



___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


RE: tripwire (re-re-post)

2003-02-18 Thread benjamin everist
Yes and no - on the fresh install of bsd, with a new(er/ est) ports 
package, I got past the 'siggen missing' error and tripwire is working 
OK.  On the original machine, i'm still getting that particular error, even 
with the updated ports.  I think I will need to CVSup that machine and try 
again.  Our firewall does not allow port 5999 in or out though, so I need 
to work on that first.

-Original Message-
From: David Donaldson [mailto:[EMAIL PROTECTED]]
Sent: Monday, February 17, 2003 04:54 PM
To: benjamin everist
Subject: RE: tripwire (re-re-post)




Did you get your tripwire working? 


To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message


RE: tripwire (re-re-post)

2003-02-16 Thread 357 Magnum
-Original Message-
From: benjamin everist [mailto:[EMAIL PROTECTED]]
Sent: Friday, 14 February 2003 5:54 AM
To: [EMAIL PROTECTED]
Subject: Fwd: tripwire (re-re-post)


Hello again.  I have tried the same (as below) on a new machine only 
minutes old - after rebooting from installing the OS I went straight to 
/usr/ports/security/tripwire and did

#make
grind grind grind
c++ -I../stlport -Wall -W -Wno-sign-compare -Wno-unused -Wno-uninitialized 
-ftem
plate-depth-32 -O2 num_put_float.cpp -c -o obj/GCC/Release/num_put_float.o
num_put_float.cpp:50: values.h: No such file or directory

according to http://www.tux.org/pub/bsd/freebsd/FreeBSD-current/src/gnu/inc
lude/values.h: (last modified in 1995!)

#warning this file includes values.h which is obsoleted, use limits.h 
or float.h instead

SO, I created a symlink in /usr/include:
#ln -s float.h values.h

which got rid of that error, make completed successfully.  But when I did
#make install
Verifying existence of binaries...

./bin/i386-unknown-freebsd_r/siggen missing.  Build did not complete 
successfully.

Same error! (as below).  doing a find:
#find / -name siggen
/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src/siggen/
and there are a couple of siggen files there.

if I do a grep -r siggen * in /usr/ports/security/tripwire I get all kinds 
of confusing crap.

does anyone have any suggestions before I go and put a symlink to siggen in 
every directory I can think of?

benjamin


awhile back, I wrote:
___
Subject: tripwire (re-post)

Did the list get this?  I've been having problems posting (so I'll try 
the same thing *extra* hard)
---

Hello -

I am trying to install tripwire-2.3.1-2 on freebsd 4.7 release.  using:
#make all install clean
or
#make
#make install
from /usr/ports/security/tripwire yields the following:

Verifying existence of binaries...

./bin/i386-unknown-freebsd_r/siggen missing.  Build did not complete 
successfully.
*** Error code 1

Stop in /usr/ports/security/tripwire.

If i untar the source and compile in /usr/local, making sure to edit the 
master Makefile (/tripwire/src/Makefile) for freebsd, i get:
#gmake release
grind grind grind
c++ -I../stlport -Wall -W -Wno-sign-compare -Wno-unused 
-Wno-uninitialized -ftem
plate-depth-32 -O2 num_put_float.cpp -c -o 
obj/GCC/Release/num_put_float.o
num_put_float.cpp:50: values.h: No such file or directory
gmake[4]: *** [obj/GCC/Release/num_put_float.o] Error 1
gmake[4]: Leaving directory 
`/usr/local/tripwire-2.3.1-2/src/STLport-4.0/src'
gmake[3]: *** [lib/libstlport_gcc.a] Error 2
gmake[3]: Leaving directory `/usr/local/tripwire-2.3.1-2/src/STLport-4.0'
gmake[2]: *** [../../lib/i386-unknown-freebsd_r/libstlport_gcc.a] Error 2
gmake[2]: Leaving directory `/usr/local/tripwire-2.3.1-2/src/STLport-4.0'
gmake[1]: *** [STLport_r] Error 2
gmake[1]: Leaving directory `/usr/local/tripwire-2.3.1-2/src'
date  release.i386-unknown-freebsd.out

Any help would be much appreciated.

Benjamin Everist


To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message



Had the same problem.  Did a cvsup and it resolved it.


_
MSN Instant Messenger now available on Australian mobile phones. Go to  
http://ninemsn.com.au/mobilecentral/hotmail_messenger.asp


To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message


Fwd: tripwire (re-re-post)

2003-02-13 Thread benjamin everist
Hello again.  I have tried the same (as below) on a new machine only 
minutes old - after rebooting from installing the OS I went straight to 
/usr/ports/security/tripwire and did

#make
grind grind grind
c++ -I../stlport -Wall -W -Wno-sign-compare -Wno-unused -Wno-uninitialized 
-ftem
plate-depth-32 -O2 num_put_float.cpp -c -o obj/GCC/Release/num_put_float.o
num_put_float.cpp:50: values.h: No such file or directory

according to 
http://www.tux.org/pub/bsd/freebsd/FreeBSD-current/src/gnu/include/values.h: 
(last modified in 1995!)

#warning this file includes values.h which is obsoleted, use limits.h 
or float.h instead

SO, I created a symlink in /usr/include:
#ln -s float.h values.h

which got rid of that error, make completed successfully.  But when I did
#make install
Verifying existence of binaries...

./bin/i386-unknown-freebsd_r/siggen missing.  Build did not complete 
successfully.

Same error! (as below).  doing a find:
#find / -name siggen
/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src/siggen/
and there are a couple of siggen files there.

if I do a grep -r siggen * in /usr/ports/security/tripwire I get all kinds 
of confusing crap.

does anyone have any suggestions before I go and put a symlink to siggen in 
every directory I can think of?

benjamin


awhile back, I wrote:

___

Subject: tripwire (re-post)

Did the list get this?  I've been having problems posting (so I'll try the 
same thing *extra* hard)
---

Hello -

I am trying to install tripwire-2.3.1-2 on freebsd 4.7 release.  using:
#make all install clean
or
#make
#make install
from /usr/ports/security/tripwire yields the following:

Verifying existence of binaries...

./bin/i386-unknown-freebsd_r/siggen missing.  Build did not complete 
successfully.
*** Error code 1

Stop in /usr/ports/security/tripwire.

If i untar the source and compile in /usr/local, making sure to edit the 
master Makefile (/tripwire/src/Makefile) for freebsd, i get:
#gmake release
grind grind grind
c++ -I../stlport -Wall -W -Wno-sign-compare -Wno-unused -Wno-uninitialized 
-ftem
plate-depth-32 -O2 num_put_float.cpp -c -o obj/GCC/Release/num_put_float.o
num_put_float.cpp:50: values.h: No such file or directory
gmake[4]: *** [obj/GCC/Release/num_put_float.o] Error 1
gmake[4]: Leaving directory `/usr/local/tripwire-2.3.1-2/src/STLport-4.0/src'
gmake[3]: *** [lib/libstlport_gcc.a] Error 2
gmake[3]: Leaving directory `/usr/local/tripwire-2.3.1-2/src/STLport-4.0'
gmake[2]: *** [../../lib/i386-unknown-freebsd_r/libstlport_gcc.a] Error 2
gmake[2]: Leaving directory `/usr/local/tripwire-2.3.1-2/src/STLport-4.0'
gmake[1]: *** [STLport_r] Error 2
gmake[1]: Leaving directory `/usr/local/tripwire-2.3.1-2/src'
date  release.i386-unknown-freebsd.out

Any help would be much appreciated.

Benjamin Everist


To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message



5.0-release and tripwire?

2003-02-12 Thread Shane Hickey
Has anyone else had problems getting tripwire from ports to compile on
5.0-release?  Here's what I'm seeing

...
mkdir -p obj/GCCi386/Release
c++ -I../stlport -Wall -W -Wno-sign-compare -Wno-unused
-Wno-uninitialized -ftemplate-depth-32 -O2 complex.cpp -c -o
obj/GCCi386/Release/complex.o
In file included from ../stlport/config/stlcomp.h:71,
 from ../stlport/stl/_config.h:69,
 from stlport_prefix.h:8,
 from complex.cpp:18:
../stlport/config/stl_gcc.h:23: redeclaration of C++ built-in type
`wchar_t'
In file included from ../stlport/complex:40,
 from complex.cpp:21:
../stlport/wrap_std/complex:16:39: ../g++-include/complex: No such file
or directory
complex.cpp:26: syntax error before `' token
complex.cpp: In function `float abs(...)':
complex.cpp:28: `__z' undeclared (first use this function)
complex.cpp:28: (Each undeclared identifier is reported only once for
each 
   function it appears in.)
complex.cpp:28: `__STL_HYPOTF' undeclared (first use this function)
complex.cpp: At global scope:
complex.cpp:31: syntax error before `' token
complex.cpp: In function `double abs(...)':
complex.cpp:32: new declaration `double abs(...)'
complex.cpp:27: ambiguates old declaration `float abs(...)'
complex.cpp: In function `float abs(...)':
complex.cpp:33: `__STL_HYPOT' undeclared (first use this function)
complex.cpp: At global scope:
complex.cpp:36: syntax error before `' token
complex.cpp: In function `long double abs(...)':
complex.cpp:37: new declaration `long double abs(...)'
complex.cpp:32: ambiguates old declaration `double abs(...)'
complex.cpp: In function `float abs(...)':
complex.cpp:38: `__STL_HYPOTL' undeclared (first use this function)
complex.cpp: At global scope:
complex.cpp:43: syntax error before `' token
complex.cpp: In function `float arg(...)':
complex.cpp:45: `__STL_ATAN2F' undeclared (first use this function)
complex.cpp: At global scope:
complex.cpp:48: syntax error before `' token
complex.cpp: In function `double arg(...)':
complex.cpp:49: new declaration `double arg(...)'
complex.cpp:44: ambiguates old declaration `float arg(...)'
complex.cpp: In function `float arg(...)':
complex.cpp:50: `__STL_ATAN2' undeclared (first use this function)
complex.cpp: At global scope:
complex.cpp:53: syntax error before `' token
complex.cpp: In function `long double arg(...)':
complex.cpp:54: new declaration `long double arg(...)'
complex.cpp:49: ambiguates old declaration `double arg(...)'
complex.cpp: In function `float arg(...)':
complex.cpp:55: `__STL_ATAN2L' undeclared (first use this function)
complex.cpp: At global scope:
complex.cpp:60: syntax error before `float'
gmake[4]: *** [obj/GCCi386/Release/complex.o] Error 1
gmake[3]: *** [lib/libstlport_gcc.a] Error 2
gmake[2]: *** [../../lib/i386-unknown-freebsd_r/libstlport_gcc.a] Error
2
gmake[1]: *** [STLport_r] Error 2
gmake[4]: Leaving directory
`/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src/STLport-4.0/src'
gmake[3]: Leaving directory
`/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src/STLport-4.0'
gmake[2]: Leaving directory
`/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src/STLport-4.0'
gmake[1]: Leaving directory
`/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src'
date  release.i386-unknown-freebsd.out

Thanks in advance for any pointers.

-- 
|Shane Hickey [EMAIL PROTECTED]
|Network/System Consultant
+-
|GPG KeyID 777CBF3F
|Key fingerprint = 254F B2AC 9939 C715 278C  DA95 4109 9F69 777C BF3F
+


To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message



5.0-release and tripwire?

2003-02-12 Thread Shane Hickey
NOTE: I had problems with my mail client and I wasn't sure if this made
it to the list or not.

Has anyone else had problems getting tripwire from ports to compile on
5.0-release?  Here's what I'm seeing

...
mkdir -p obj/GCCi386/Release
c++ -I../stlport -Wall -W -Wno-sign-compare -Wno-unused
-Wno-uninitialized -ftemplate-depth-32 -O2 complex.cpp -c -o
obj/GCCi386/Release/complex.o
In file included from ../stlport/config/stlcomp.h:71,
 from ../stlport/stl/_config.h:69,
 from stlport_prefix.h:8,
 from complex.cpp:18:
../stlport/config/stl_gcc.h:23: redeclaration of C++ built-in type
`wchar_t'
In file included from ../stlport/complex:40,
 from complex.cpp:21:
../stlport/wrap_std/complex:16:39: ../g++-include/complex: No such file
or directory
complex.cpp:26: syntax error before `' token
complex.cpp: In function `float abs(...)':
complex.cpp:28: `__z' undeclared (first use this function)
complex.cpp:28: (Each undeclared identifier is reported only once for
each 
   function it appears in.)
complex.cpp:28: `__STL_HYPOTF' undeclared (first use this function)
complex.cpp: At global scope:
complex.cpp:31: syntax error before `' token
complex.cpp: In function `double abs(...)':
complex.cpp:32: new declaration `double abs(...)'
complex.cpp:27: ambiguates old declaration `float abs(...)'
complex.cpp: In function `float abs(...)':
complex.cpp:33: `__STL_HYPOT' undeclared (first use this function)
complex.cpp: At global scope:
complex.cpp:36: syntax error before `' token
complex.cpp: In function `long double abs(...)':
complex.cpp:37: new declaration `long double abs(...)'
complex.cpp:32: ambiguates old declaration `double abs(...)'
complex.cpp: In function `float abs(...)':
complex.cpp:38: `__STL_HYPOTL' undeclared (first use this function)
complex.cpp: At global scope:
complex.cpp:43: syntax error before `' token
complex.cpp: In function `float arg(...)':
complex.cpp:45: `__STL_ATAN2F' undeclared (first use this function)
complex.cpp: At global scope:
complex.cpp:48: syntax error before `' token
complex.cpp: In function `double arg(...)':
complex.cpp:49: new declaration `double arg(...)'
complex.cpp:44: ambiguates old declaration `float arg(...)'
complex.cpp: In function `float arg(...)':
complex.cpp:50: `__STL_ATAN2' undeclared (first use this function)
complex.cpp: At global scope:
complex.cpp:53: syntax error before `' token
complex.cpp: In function `long double arg(...)':
complex.cpp:54: new declaration `long double arg(...)'
complex.cpp:49: ambiguates old declaration `double arg(...)'
complex.cpp: In function `float arg(...)':
complex.cpp:55: `__STL_ATAN2L' undeclared (first use this function)
complex.cpp: At global scope:
complex.cpp:60: syntax error before `float'
gmake[4]: *** [obj/GCCi386/Release/complex.o] Error 1
gmake[3]: *** [lib/libstlport_gcc.a] Error 2
gmake[2]: *** [../../lib/i386-unknown-freebsd_r/libstlport_gcc.a] Error
2
gmake[1]: *** [STLport_r] Error 2
gmake[4]: Leaving directory
`/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src/STLport-4.0/src'
gmake[3]: Leaving directory
`/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src/STLport-4.0'
gmake[2]: Leaving directory
`/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src/STLport-4.0'
gmake[1]: Leaving directory
`/usr/ports/security/tripwire/work/tripwire-2.3.1-2/src'
date  release.i386-unknown-freebsd.out

Thanks in advance for any pointers.

-- 
|Shane Hickey [EMAIL PROTECTED]
|Network/System Consultant
+-
|GPG KeyID 777CBF3F
|Key fingerprint = 254F B2AC 9939 C715 278C  DA95 4109 9F69 777C BF3F
+


To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message



tripwire (re-post)

2003-02-06 Thread benjamin everist
Did the list get this?  I've been having problems posting (so I'll try the 
same thing *extra* hard)
---

Hello -

I am trying to install tripwire-2.3.1-2 on freebsd 4.7 release.  using:
#make all install clean
or
#make
#make install
from /usr/ports/security/tripwire yields the following:

Verifying existence of binaries...

./bin/i386-unknown-freebsd_r/siggen missing.  Build did not complete 
successfully.
*** Error code 1

Stop in /usr/ports/security/tripwire.

If i untar the source and compile in /usr/local, making sure to edit the 
master Makefile (/tripwire/src/Makefile) for freebsd, i get:
#gmake release
grind grind grind
c++ -I../stlport -Wall -W -Wno-sign-compare -Wno-unused -Wno-uninitialized 
-ftem
plate-depth-32 -O2 num_put_float.cpp -c -o obj/GCC/Release/num_put_float.o
num_put_float.cpp:50: values.h: No such file or directory
gmake[4]: *** [obj/GCC/Release/num_put_float.o] Error 1
gmake[4]: Leaving directory `/usr/local/tripwire-2.3.1-2/src/STLport-4.0/src'
gmake[3]: *** [lib/libstlport_gcc.a] Error 2
gmake[3]: Leaving directory `/usr/local/tripwire-2.3.1-2/src/STLport-4.0'
gmake[2]: *** [../../lib/i386-unknown-freebsd_r/libstlport_gcc.a] Error 2
gmake[2]: Leaving directory `/usr/local/tripwire-2.3.1-2/src/STLport-4.0'
gmake[1]: *** [STLport_r] Error 2
gmake[1]: Leaving directory `/usr/local/tripwire-2.3.1-2/src'
date  release.i386-unknown-freebsd.out

Any help would be much appreciated.

Benjamin Everist 


To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message


Re: tripwire (re-post)

2003-02-06 Thread Kirk Strauser
At 2003-02-06T23:28:13Z, benjamin everist [EMAIL PROTECTED] writes:

 I am trying to install tripwire-2.3.1-2 on freebsd 4.7 release.  using:
 #make all install clean
 or
 #make
 #make install

The same problem started a chain reaction that ended with me installing
AIDE.  Just a thought.
-- 
Kirk Strauser
In Googlis non est, ergo non est.



msg18321/pgp0.pgp
Description: PGP signature


trouble with tripwire

2003-02-05 Thread benjamin everist
Hello -

I am trying to install tripwire-2.3.1-2 on freebsd 4.7 release.  using:
#make all install clean
or
#make
#make install
from /usr/ports/security/tripwire yields the following:

Verifying existence of binaries...

./bin/i386-unknown-freebsd_r/siggen missing.  Build did not complete 
successfully.
*** Error code 1

Stop in /usr/ports/security/tripwire.

If i untar the source and compile in /usr/local, making sure to edit the 
master Makefile (/tripwire/src/Makefile) for freebsd, i get:
#gmake release
grind grind grind
c++ -I../stlport -Wall -W -Wno-sign-compare -Wno-unused -Wno-uninitialized 
-ftem
plate-depth-32 -O2 num_put_float.cpp -c -o obj/GCC/Release/num_put_float.o
num_put_float.cpp:50: values.h: No such file or directory
gmake[4]: *** [obj/GCC/Release/num_put_float.o] Error 1
gmake[4]: Leaving directory `/usr/local/tripwire-2.3.1-2/src/STLport-4.0/src'
gmake[3]: *** [lib/libstlport_gcc.a] Error 2
gmake[3]: Leaving directory `/usr/local/tripwire-2.3.1-2/src/STLport-4.0'
gmake[2]: *** [../../lib/i386-unknown-freebsd_r/libstlport_gcc.a] Error 2
gmake[2]: Leaving directory `/usr/local/tripwire-2.3.1-2/src/STLport-4.0'
gmake[1]: *** [STLport_r] Error 2
gmake[1]: Leaving directory `/usr/local/tripwire-2.3.1-2/src'
date  release.i386-unknown-freebsd.out

Any help would be much appreciated.

Benjamin Everist


To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message


Tripwire replacement

2002-11-21 Thread dslb
Hi all

I remember reading something about a new program that makes tripwire obsolute,
but I can't remember the name. Maybe someone in here can tell me what programs
it is and if it is true, that it is better than tripwire?

br
socketd


To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message



Re: Tripwire replacement

2002-11-21 Thread Kliment Andreev

I remember reading something about a new program that makes tripwire
obsolute, but I can't remember the name. Maybe someone in here can tell
me what programs it is and if it is true, that it is better than tripwire?

Aide or Trisentry?

http://www.onlamp.com/lpt/a/2837 for Trisentry.



To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message