Tripwire 2.3

Tom Mitchell mitch48 at sbcglobal.net
Mon Dec 29 23:45:53 UTC 2003


On Mon, 29 Dec 2003, Rick Stevens wrote:
> Geffrey Velásquez [Minag] wrote:
> > Friends, how could I change the sender of the email notification of tripwire
> > 2.3? by default is: tripwire at hostname   but it causes some problems...
> 
> You could tweak the MAILPROGRAM= variable in twcfg.txt to include a
> different envelope sender by using the "-f user at domain" option.  Beyond
> that, I think it's built into the binary.

One simple option is to add an alias in /etc/aliases that
redirects the mail as you wish.

However I see comments in the base line twpol.txt/
twpol.txt.rpmnew file:

 # Email support is not included and must be added to this file.   
 # Add the 'emailto=' to the rule directive section of each rule (add a comma
 # after the 'severity=' line and add an 'emailto=' and include the email
 # addresses you want the violation reports to go to).  Addresses are 
 # semi-colon delimited.

And if I recall the policy text file must be regenerated for
tripwire to accept changes.  The policy will commonly have been
updated (see tripwire --update --twrfile ....) i.e. RTFM look for
"twadmin --create-cfgfile" and the like.  tripwire will be
selective with changes so again RTFM.

The man page for "twconfig" notes the global variable
GLOBALEMAIL. Scanning notes in a handy source pile there were
some comments on bugs where apparently at least one rule with
"emailto=" is needed. Your version may not have this issue.

Perhaps you are looking at the tripwire report mail sent by cron
or anacron, /etc/cron.daily....  if so then the your question is 
how to redirect mail from a specific cron job run by root but the
mail goes to 'bob'. Is it?

--
	T o m  M i t c h e l l
	mitch48 -a*t- yahoo-dot-com





More information about the users mailing list