Tripwire 2.3
Tom Mitchell
mitch48 at sbcglobal.net
Mon Dec 29 23:45:53 UTC 2003
On Mon, 29 Dec 2003, Rick Stevens wrote:
> Geffrey Velásquez [Minag] wrote:
> > Friends, how could I change the sender of the email notification of tripwire
> > 2.3? by default is: tripwire at hostname but it causes some problems...
>
> You could tweak the MAILPROGRAM= variable in twcfg.txt to include a
> different envelope sender by using the "-f user at domain" option. Beyond
> that, I think it's built into the binary.
One simple option is to add an alias in /etc/aliases that
redirects the mail as you wish.
However I see comments in the base line twpol.txt/
twpol.txt.rpmnew file:
# Email support is not included and must be added to this file.
# Add the 'emailto=' to the rule directive section of each rule (add a comma
# after the 'severity=' line and add an 'emailto=' and include the email
# addresses you want the violation reports to go to). Addresses are
# semi-colon delimited.
And if I recall the policy text file must be regenerated for
tripwire to accept changes. The policy will commonly have been
updated (see tripwire --update --twrfile ....) i.e. RTFM look for
"twadmin --create-cfgfile" and the like. tripwire will be
selective with changes so again RTFM.
The man page for "twconfig" notes the global variable
GLOBALEMAIL. Scanning notes in a handy source pile there were
some comments on bugs where apparently at least one rule with
"emailto=" is needed. Your version may not have this issue.
Perhaps you are looking at the tripwire report mail sent by cron
or anacron, /etc/cron.daily.... if so then the your question is
how to redirect mail from a specific cron job run by root but the
mail goes to 'bob'. Is it?
--
T o m M i t c h e l l
mitch48 -a*t- yahoo-dot-com
More information about the users
mailing list