Tripwire is a program that reports changes to binaries. Tripwire reads the data from a floppy, which can be set as read-only, which provides a greater level of security.

Set up

  1. Format a floppy with a Unix file system: fdformat
  2. Create a new filesystem
    newfs /vol/dev/diskette0/unnamed_floppy
    
    Note that on the Mho cluster, the directory would be /vold instead of /vol.
  3. Eject and then mount the floppy:
    eject floppy
    volcheck
    
  4. Go to a machine that already has tripwire on it and copy the contents of the floppy to a directory that is shared between the old and new machine.
  5. Copy tcheck to the new floppy
    cp -r ~/src/tcheck /floppy/unnamed_floppy
    
  6. Remove the old database and update
    cd /floppy/unnamed_floppy/tcheck
    ./tripwire -initialize
    
  7. cd to the root directory, eject the floppy, write protect the floppy
    cd /
    eject floppy
    
  8. Add the following cron job entry:
    #
    # tripwire
    10 11 * * * /bin/csh -c '/bin/volcheck; cd /floppy/floppy0/tcheck; ./tripwire'
    #