About This GuideDocument ListConventionsSupportTripwire Professional ServicesTripwire Educational ServicesContentsConfiguration FilesOverviewIntroduction to Configuration FilesConfiguration File ParametersPaths to Data FilesPolicy FileDatabase FileReport FileSite Key FileLocal Key FileData Files PermissionsPolicy RightsDatabase RightsReport RightsTemporary DirectoryIntegrity Checking ParametersLoose Directory CheckingReset Access TimeTraverse Mount PointsE-mail ParametersMail MethodMail ProgramSMTP HostSMTP PortFrom AddressMail No ViolationsE-mail Report LevelGlobal E-mail AddressCharacter (Mail) EncodingLogging ParametersSyslog ReportingSyslog Report LevelSyslog HostAudit LogSNMP ParametersSNMP HostSNMP PortSNMP CommunityOther Operations ParametersLate PromptingReport LevelEditorAgent Configuration FileTripwire Agent ParametersPORTNUMBERIPADDRESSTWCFGFILESITEKEYFILETRIPWIRETWADMINTWPRINTAUTHKEYFILEAUTHKEYFILERIGHTSSCHEDULEFILESCHEDULEFILERIGHTSTASKFILETASKFILERIGHTSLOGFILELOGFILERIGHTSThe Policy FileOverviewIntroduction to the Policy FileDefault Policy FilesPolicy File ResourcesIntroduction to the Policy File LanguageCommentsRulesRule AttributesVariablesStop PointsDirectivesPolicy File SectionsHow to Section a Policy FileRulesConstructing RulesObject NamesUNIX File System Object NamesWindows File System Object NamesWindows Registry Object NamesSpecial Characters in Object NamesRestricted Characters in UNIX Object NamesRestricted Characters in Windows Object NamesNonprintable Characters in UNIX Object NamesHexadecimal, Octal, or Unicode CharactersDouble-byte CharactersWildcardsWhite SpacePropertiesProperty IssuesProperties for UNIX File System ObjectsProperties for Windows File System ObjectsProperties for Windows Registry Key ObjectsProperties for Windows Registry Value ObjectsRule AttributesSpecifying Rule NamesSpecifying Severity LevelsDefault SeveritySeverity in Tripwire ManagerSpecifying RecursionTurning Recursion OffNumerical Recursion LevelsSending E-mail ReportsSpecifying E-mail AddressesGlobal E-mailUsing Rule Attributes to Construct Rule BlocksIndividual Rule Attributes in Rule BlocksNesting Rule BlocksVariablesPredefined VariablesPredefined Variables for UNIX File SystemPredefined Variables for Windows File SystemPredefined Variables for Windows RegistryPredefined Variables for Windows Registry ValuesUser-Defined VariablesVariable SubstitutionStop PointsDirectivesDirective IssuesDeclaring SectionsConditional LogicNested Conditional LogicDebugging and DiagnosticsLogical End of the Policy FileAppendicesAppendix A: Windows Security AttributesAppendix B: Sample ReportsLevel 0: Single Line ReportLevel 1: Parsable List of ViolationsLevel 2: Summary ReportLevel 3: Concise ReportLevel 4: Full ReportAppendix C: Viewing Exit CodesIntegrity Checking ModeGlossaryIndexTripwire2.4Reference Guide© 2001 Tripwire, Inc. Tripwire is a registered trademark of Tripwire, Inc. All rights reserved.Microsoft, Windows, Windows NT, and Windows 2000 are registered trademarks of Microsoft Corporation.UNIX is a registered trademark of The Open Group.Linux is a registered trademark of Linus Torvalds.Java and all Java-based marks are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries. All other brand or product names may be trademarks or registered trademarks of their respective companies or organizations.This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org).Tripwire, Inc.326 SW Broadway, 3rd FloorPortland, OR 97205tel: 1.877.TRIPWIREfax: 503.223.0182http://[email protected] TW1003-02About This GuideAbout This GuideTripwire Reference Guide vDocument ListThe Tripwire Installation Guide describes installation procedures for Tripwire Manager and Tripwire for Servers software.The Tripwire for Servers User Guide describes configuration and operation of Tripwire for Servers software.The Tripwire Manager User Guide describes configuration and operation of Tripwire Manager software, which is used to manage multiple installations of Tripwire for Servers software. The Tripwire Reference Guide contains detailed information about the Tripwire configuration and policy files. The Quick Reference Cards summarize important functionality of Tripwire for Servers software.You can access PDF versions of the Guides from the docs directories on the Tripwire Manager and Tripwire for Servers CDs. You can access online help from the Tripwire Manager interface.About This Guidevi Tripwire Reference GuideConventionsThis Guide uses the following typographic conventions.Bold in regular text indicates FTP and HTTP URLs, and emphasizes important issues.Italic indicates file and directory names.Constant in regular text shows commands and command-line options, and policy file rule attributes, directives, and variables.Sans Serif in examples shows actual user input on the command line.Sans Serif Italicin examples shows variables which should be replaced with context-specific values.denotes sections of the text that apply only to Windows installations of Tripwire software. Unless otherwise specified, all references to Windows refer to both Windows NT and Windows 2000.denotes sections of the text that apply only to UNIX or Linux installations of Tripwire software. Unless otherwise specified, all references to UNIX also refer to Linux.[options] the command reference section shows optional command-line arguments in brackets.{ 1 | 2 | 3 } the command reference section shows sets of possible options in braces, separated by the | character. Choose only one of the options. Unless otherwise specified, command-line examples assume that the Tripwire bin directory is the current working directory.WUAbout This GuideTripwire Reference Guide viiSupportFor the latest information and support for Tripwire products, visit the Tripwire website or contact Tripwire Technical Support. Tripwire Support Website: http://www.tripwire.com/supportTripwire Technical Support:e-mail: [email protected]: 1.866.TWSUPPORT (6am-6pm Pacific)phone: 503.276.7663General information: [email protected] Professional ServicesTripwire Professional Services provides flexible service and support to meet your specific technical and deployment needs. If you would like Tripwire software deployment and implementation assistance, or additional training in using Tripwire software products, visit http://www.tripwire.com or