TWFILES(5)

💅 TWFILES — the whole file fam, explained

okay bestie, so this is twfiles from section 5 of the manual — it's the big-picture tour of every file Tripwire touches, plus how the backup thing works. no cap, it's giving "here's where everything lives" energy. 🗂️✨

---

🌸 NAME 🌸

twfiles — an overview of the files used by Tripwire, plus the file backup process. literally just the map of the whole kingdom, iykyk. 👑

---

🎀 DESCRIPTION 🎀

💖 Configuration File 💖

default: /etc/tripwire/tw.cfg

So this file holds all the system-specific deets — like where Tripwire's data files actually live. The settings get generated while you're installing, but the system administrator can change them literally any time they want. For the full tea, go read the twconfig(4) man page. 🛠️

🦋 Policy File 🦋

default: /etc/tripwire/tw.pol

This one is a whole series of rules that spell out which system objects Tripwire should be monitoring, and — for each object — what data should get collected and stashed in the database file. And if something unexpected goes down? The policy file can also describe who should be notified and how severe the violation is. For more, check the policyguide.txt file in the policy directory and the twpolicy(4) man page. 📜

🍓 Database File 🍓

default: /var/lib/$(HOSTNAME).twd

This is the baseline for integrity checking — the whole point. After installation, Tripwire creates the initial database file, which is basically a "snapshot" of the filesystem in a known secure state. Later, when an integrity check runs, Tripwire compares every system object described in the policy file against its matching entry in the database. A report gets created, and if an object changed outside the constraints defined in the policy file, boom — a violation is reported. See tripwire(8) and twprint(8) for more on creating and maintaining database files. 🔍

🌈 Report Files 🌈

default: /var/lib/tripwire/report/$(HOSTNAME)‐$(DATE).twr

Once those three files above exist, Tripwire can run an integrity check and hunt for any differences between the current system and the data stored in the "baseline" Tripwire database. All that info gets archived into report files — a collection of rule violations discovered during an integrity check. And with the right settings, a report can even be emailed to one or more recipients. See tripwire(8) and twprint(8) for info on creating and printing report files. 📬

🔑 Key Files 🔑

defaults: /etc/tripwire/site.key and /etc/tripwire/$(HOSTNAME)‐local.key

⚠️ okay this part is serious — it is critical that Tripwire files be protected from unauthorized access. an attacker who can modify these files can subvert Tripwire's operation. like, fully. 😭

That's exactly why all of the files above are signed using public key cryptography — to prevent unauthorized modification. Two separate sets of keys protect the critical Tripwire data files, and one or both of these key sets is necessary for performing almost every Tripwire task. no keys, no vibes. 💀

• The site key — protects files that could be used across several systems. That includes the policy and configuration files. 🌐
• The local key — protects files specific to the local machine, like the Tripwire database. The local key may also be used for signing integrity check reports. 💻

See the twadmin(8) man page for more info on keys. 🗝️

🧚 File Backup 🧚

To prevent the accidental deletion of important data, Tripwire automatically creates backup files whenever any Tripwire file is overwritten. Here's the move: the existing file gets renamed with a .bak extension, and the new version of the file takes its place. Only one backup copy for each filename can exist at any time — so if a backup copy of a file already exists, the older backup file gets deleted and replaced with the newer one. out with the old, in with the new, periodt. 🔄

File backup is an integral part of Tripwire, and it cannot be removed or changed. it's not a setting, it's a lifestyle. 🙈

---

⭐ VERSION INFORMATION ⭐

This man page describes Tripwire 2.4. 💫

---

👑 AUTHORS 👑

Tripwire, Inc. 🫶

---

📝 COPYING PERMISSIONS 📝

Permission is granted to make and distribute verbatim copies of this man page provided the copyright notice and this permission notice are preserved on all copies. ✅

Permission is granted to copy and distribute modified versions of this man page under the conditions for verbatim copying, provided that the entire resulting derived work is distributed under the terms of a permission notice identical to this one. ✅

Permission is granted to copy and distribute translations of this man page into another language, under the above conditions for modified versions, except that this permission notice may be stated in a translation approved by Tripwire, Inc. ✅

Copyright 2000-2018 Tripwire, Inc. Tripwire is a registered trademark of Tripwire, Inc. in the United States and other countries. All rights reserved. ©️

---

🔥 SEE ALSO 🔥

twintro(8), tripwire(8), twadmin(8), twprint(8), siggen(8), twconfig(4), twpolicy(4) — go read them, bestie, they're all connected 🦋

---

mwah 💋 this page is from Open Source Tripwire 2.4, dated 04 Jan 2018 — that's the version and date, and yes we're citing them properly because we're iconic like that. now go check your baselines. 🎀✨