TWADMIN(8)

📦
version 2.4.3.7 · 2 versions
, in epel 10, epel 9, fedora 43, fedora 44, opensuse-leap 16.0

💅 twadmin — Tripwire administrative & utility tool (TWADMIN(8), System Manager's Manual)

okay so bestie, welcome to twadmin, the Tripwire administrative and utility tool ✨ This is the one that handles all the grown-up paperwork for your Tripwire files and config options — like, it lets you encode, decode, sign, and verify Tripwire files, AND it's your girl for generating and changing local and site keys 🔑

🌸 SYNOPSIS 🌸

twadmin { -m F | --create-cfgfile }  options...
     configfile.txt
twadmin { -m f | --print-cfgfile } [ options... ]
twadmin { -m P | --create-polfile } [ options... ]
     policyfile.txt
twadmin { -m p | --print-polfile } [ options... ]
twadmin { -m R | --remove-encryption } [ options... ]
     file1 [ file2... ]
twadmin { -m E | --encrypt } [ options... ]
     file1 [ file2... ]
twadmin { -m e | --examine } [ options... ]
     file1 [ file2... ]
twadmin { -m G | --generate-keys } options...
twadmin { -m C | --change-passphrases } options...

🦋 DESCRIPTION 🦋

So twadmin does certain administrative functions related to Tripwire files and configuration options 💖 Specifically, twadmin lets you encode, decode, sign, and verify Tripwire files, and it also gives you a way to generate and change local and site keys. That's the whole vibe check. 🔥

🎀 Creating a configuration file (--create-cfgfile)

This command mode designates an existing text file as the new configuration file for Tripwire, no cap. The plain text configuration file must be specified on the command line. Using the site key, the new configuration file is encoded and saved. 💫

🎀 Printing a configuration file (--print-cfgfile)

This command mode prints the specified encoded and signed configuration file in clear-text form to standard output. It's giving transparency, honestly. 🪞

🎀 Replacing a policy file (--create-polfile)

This command mode designates an existing text file as the new policy file for Tripwire. The plain text policy file must be specified on the command line. Using the site key, the new policy file is encoded and saved. 📜

🎀 Printing a policy file (--print-polfile)

This command mode prints the specified encoded and signed policy file in clear-text form to standard output. ✨

🎀 Removing encryption from a file (--remove-encryption)

This command mode lets you remove signing from signed configuration, policy, database, or report files. Multiple files may be specified on the command line. You'll need to enter the appropriate local or site keyfile — or both, if a combination of files is to be verified. 💅

heads up bestie: even with the cryptographic signing removed, these files will be in a binary encoded (non-human-readable) form. So like, don't expect to open them and read them, ok? 😭

🎀 Encrypting a file (--encrypt)

This command mode lets you sign configuration, policy, database files, or reports. Multiple files may be specified on the command line. The files will be signed using either the site or local key, as appropriate for the type of file. And to automate the process, the passphrase for the key files can be included on the command line. 🫶

🎀 Examining the signing status of a file (--examine)

This command lets you examine the listed files and print a report of their signing status. The report displays the filename, file type, whether or not a file is signed, and what key (if any) is used to sign it. Forensic queen behavior, honestly. 🔍

🎀 Generating keys (--generate-keys)

This command mode generates site and/or local key files with names specified by the user. Make your own keys, main character energy. 👑🔑

🎀 Changing passphrases (--change-passphrases)

This command reencrypts the private part of the site and/or local key files using the key filenames and passphrases specified by the user. New password era 💜

⭐ OPTIONS ⭐

💖 Creating a configuration file:

-m F            --create-cfgfile
-v              --verbose
-s              --silent, --quiet
-c cfgfile      --cfgfile cfgfile
-S sitekey      --site-keyfile sitekey
-Q passphrase   --site-passphrase passphrase
-e              --no-encryption
configfile.txt
  • -m F, --create-cfgfile — mode selector, the "what are we even doing here" pick 💅
  • -v, --verbose — verbose output mode. Mutually exclusive with (-s), so pick one, bestie, you can't have both 🫠
  • -s, --silent, --quiet — silent output mode. Mutually exclusive with (-v).
  • -c cfgfile, --cfgfile cfgfile — specify the destination of the encoded (and optionally signed) configuration file. Like, where it's going. 📍
  • -S sitekey, --site-keyfile sitekey — use the specified site key file to encode and sign the new configuration file. Exactly one of (-S) or (-e) must be specified — exactly one, no cap ⚠️
  • -Q passphrase, --site-passphrase passphrase — specifies passphrase to be used with site key for configuration file encoding and signing. Valid only in conjunction with (-S). 🤫
  • -e, --no-encryption — do not sign the configuration file being stored. The configuration file will still be compressed, and will not be human-readable. Mutually exclusive with (-Q) and (-S). 💀
  • configfile.txt — specifies the text configuration file that will become the new configuration file. ✨

💖 Printing a configuration file:

-m f           --print-cfgfile
-v             --verbose
-s             --silent, --quiet
-c cfgfile     --cfgfile cfgfile
  • -m f, --print-cfgfile — mode selector. 🎯
  • -v, --verbose — verbose output mode. Mutually exclusive with (-s).
  • -s, --silent, --quiet — silent output mode. Mutually exclusive with (-v).
  • -c cfgfile, --cfgfile cfgfile — print the specified configuration file. 🖨️

💖 Creating a policy file:

-m P            --create-polfile
-v              --verbose
-s              --silent, --quiet
-c cfgfile      --cfgfile cfgfile
-p polfile      --polfile polfile
-S sitekey      --site-keyfile sitekey
-Q passphrase   --site-passphrase passphrase
-e              --no-encryption
policyfile.txt
  • -m P, --create-polfile — mode selector. 🎯
  • -v, --verbose — verbose output mode. Mutually exclusive with (-s).
  • -s, --silent, --quiet — silent output mode. Mutually exclusive with (-v).
  • -c cfgfile, --cfgfile cfgfile — use the specified configuration file. 🗂️
  • -p polfile, --polfile polfile — specify the destination of the encoded (and optionally signed) policy file. 📍
  • -S sitekey, --site-keyfile sitekey — use the specified site key file. Mutually exclusive with (-e).
  • -Q passphrase, --site-passphrase passphrase — specifies passphrase to be used with site key for policy signing. Mutually exclusive with (-e). 🤫
  • -e, --no-encryption — do not sign the policy file being stored. The policy file will still be compressed, and will not be human-readable. Mutually exclusive with (-Q) and (-S). 💀
  • policyfile.txt — specifies the text policy file that will become the new policy file. ✨

💖 Printing a policy file:

-m p           --print-polfile
-v             --verbose
-s             --silent, --quiet
-c cfgfile     --cfgfile cfgfile
-p polfile     --polfile polfile
-S sitekey     --site-keyfile sitekey
  • -m p, --print-polfile — mode selector. 🎯
  • -v, --verbose — verbose output mode. Mutually exclusive with (-s).
  • -s, --silent, --quiet — silent output mode. Mutually exclusive with (-v).
  • -c cfgfile, --cfgfile cfgfile — use the specified configuration file. 🗂️
  • -p polfile, --polfile polfile — print the specified policy file. 🖨️
  • -S sitekey, --site-keyfile sitekey — use the specified site key file. 🔑

💖 Removing encryption from a file:

-m R            --remove-encryption
-v              --verbose
-s              --silent, --quiet
-c cfgfile      --cfgfile cfgfile
-L localkey     --local-keyfile localkey
-S sitekey      --site-keyfile sitekey
-P passphrase   --local-passphrase passphrase
-Q passphrase   --site-passphrase passphrase
file1 [ file2... ]
  • -m R, --remove-encryption — mode selector. 🎯
  • -v, --verbose — verbose output mode. Mutually exclusive with (-s).
  • -s, --silent, --quiet — silent output mode. Mutually exclusive with (-v).
  • -c cfgfile, --cfgfile cfgfile — use the specified configuration file. 🗂️
  • -L localkey, --local-keyfile localkey — specify the local keyfile to use to verify database files and reports. 🗄️
  • -S sitekey, --site-keyfile sitekey — specify the site keyfile to use to verify configuration and policy files. 🔑
  • -P passphrase, --local-passphrase passphrase — specify the passphrase to use when verifying with the old local keyfile. 🤫 (yes, "old" — that's the word, don't come for me)
  • -Q passphrase, --site-passphrase passphrase — specify the passphrase to use when verifying with the old site keyfile. 🤫
  • file1 [ file2... ] — list of files from which signing is to be removed. ✂️

💖 Encrypting a file:

-m E            --encrypt
-v              --verbose
-s              --silent, --quiet
-c cfgfile      --cfgfile cfgfile
-L localkey     --local-keyfile localkey
-S sitekey      --site-keyfile sitekey
-P passphrase   --local-passphrase passphrase
-Q passphrase   --site-passphrase passphrase
file1 [ file2... ]
  • -m E, --encrypt — mode selector. 🎯
  • -v, --verbose — verbose output mode. Mutually exclusive with (-s).
  • -s, --silent, --quiet — silent output mode. Mutually exclusive with (-v).
  • -c cfgfile, --cfgfile cfgfile — use the specified configuration file. 🗂️
  • -L localkey, --local-keyfile localkey — specify the local keyfile to use to sign database files and reports. 🗄️
  • -S sitekey, --site-keyfile sitekey — specify the site keyfile to use to sign configuration and policy files. 🔑
  • -P passphrase, --local-passphrase passphrase — specify the passphrase to use when signing with the local keyfile. 🤫
  • -Q passphrase, --site-passphrase passphrase — specify the passphrase to use when signing with the site keyfile. 🤫
  • file1 [ file2... ] — list of files to sign using the new key(s). ✍️

💅 Examining the encryption status of a file

Bestie, this mode is your little peek-behind-the-curtain moment — you point it at files and it tells you what's encrypted, no changes, no drama. Here's the whole shape of it:

   -m e           --examine
   -v             --verbose
   -s             --silent, --quiet
   -c cfgfile     --cfgfile cfgfile
   -L localkey    --local-keyfile localkey
   -S sitekey     --site-keyfile sitekey
   file1 [ file2... ]
  • -m e, --examine — the mode selector, aka "hey twadmin, we're doing the examining thing."
  • -v, --verbose — chatty output mode. Mutually exclusive with (-s), so pick a lane bestie, you can't be both loud and quiet.
  • -s, --silent, --quiet — silent output mode. Mutually exclusive with (-v). Iconic introvert energy.
  • -c cfgfile, --cfgfile cfgfile — use the specified configuration file.
  • -L localkey, --local-keyfile localkey — specifies the key to use as a local key.
  • -S sitekey, --site-keyfile sitekey — specifies the key to use as a site key.
  • file1 [ file2... ] — the list of files to examine. Yes plural, bring the whole group chat.

🔑 Generating keys

Time to make some brand-new keys, fr fr. The synopsis:

   -m G            --generate-keys
   -v              --verbose
   -s              --silent, --quiet
   -L localkey     --local-keyfile localkey
   -S sitekey      --site-keyfile sitekey
   -P passphrase   --local-passphrase passphrase
   -Q passphrase   --site-passphrase passphrase
  • -m G, --generate-keys — mode selector. This is the "we're birthing keys" flag.
  • -v, --verbose — verbose output mode. Mutually exclusive with (-s).
  • -s, --silent, --quiet — silent output mode. Mutually exclusive with (-v).
  • -L localkey, --local-keyfile localkey — generate the local key into the specified file. At least one of (-L) or (-S) must be specified. 👑
  • -S sitekey, --site-keyfile sitekey — generate the site key into the specified file. At least one of (-S) or (-L) must be specified.
  • -P passphrase, --local-passphrase passphrase — specify the local passphrase to be used when generating the local key.
  • -Q passphrase, --site-passphrase passphrase — specify the site passphrase to be used when generating the site key.
  • -K size, --key-size size — specify the key size (1024 or 2048 bits) when generating keys. (Default is 1024.) Lowkey the moment of truth for how beefy your key is.
Heads up: notice -K / --key-size shows up in the option list here even though it's not in the synopsis block above — that's just how the page is laid out, so don't @ me.

🎀 Changing passphrases

Glow-up time for your passphrases — same keys, new secret words. The menu:

   -m C            --change-passphrases
   -v              --verbose
   -s              --silent, --quiet
   -L localkey     --local-keyfile localkey
   -S sitekey      --site-keyfile sitekey
   -P passphrase   --local-passphrase passphrase
   -Q passphrase   --site-passphrase passphrase
                   --local-passphrase-old passphraseOld
                   --site-passphrase-old passphraseOld
  • -m C, --change-passphrases — mode selector, the "we're doing a passphrase refresh" one.
  • -v, --verbose — verbose output mode. Mutually exclusive with (-s).
  • -s, --silent, --quiet — silent output mode. Mutually exclusive with (-v).
  • -L localkey, --local-keyfile localkey — change the passphrase used to encrypt the private key in the specified localkey file. At least one of (-L) or (-S) must be specified.
  • -S sitekey, --site-keyfile sitekey — change the passphrase used to encrypt the private key in the specified sitekey file. At least one of (-L) or (-S) must be specified.
  • -P passphrase, --local-passphrase passphrase — specify the passphrase used to encrypt the private key in the specified localkey file.
  • -Q passphrase, --site-passphrase passphrase — specify the passphrase used to encrypt the private key in the specified sitekey file.
  • --local-passphrase-old passphraseOld — specify the passphrase used to decrypt the private key in the specified localkey file.
  • --site-passphrase-old passphraseOld — specify the passphrase used to decrypt the private key in the specified sitekey file.
Note the old-passphrase options have no short forms — long flags only, so type them out, bestie. 🙈

🚦 EXIT STATUS

Super simple, the way we like it: twadmin exits 0 on success, 1 on error. That's it. That's the whole vibe check.

📌 VERSION INFORMATION

This man page describes twadmin version 2.4. Periodt.

👑 AUTHORS

Tripwire, Inc. — the whole entire author credit.

📜 COPYING PERMISSIONS

Okay so the legal bit, but it's genuinely good news — lots of permission granted here:

Permission is granted to make and distribute verbatim copies of this man page provided the copyright notice and this permission notice are preserved on all copies.

Permission is granted to copy and distribute modified versions of this man page under the conditions for verbatim copying, provided that the entire resulting derived work is distributed under the terms of a permission notice identical to this one.

Permission is granted to copy and distribute translations of this man page into another language, under the above conditions for modified versions, except that this permission notice may be stated in a translation approved by Tripwire, Inc.

Copyright 2000-2018 Tripwire, Inc. Tripwire is a registered trademark of Tripwire, Inc. in the United States and other countries. All rights reserved.

So yeah — copy it, translate it, remix it, just keep the notices intact, mwah. 💖

🦋 SEE ALSO

Go read the rest of the family, they're all linked up:

twintro(8), tripwire(8), twprint(8), siggen(8), twconfig(4), twpolicy(4), twfiles(5)

Okay that's the whole page, bestie 🌈 — brought to you by Open Source Tripwire 2.4, dated 04 Jan 2018. Go forth and keep those keys cute and those passphrases secret 💅✨

📦 where this page comes from