Very Computer

Thanks to a recent posting and a reference to the vfaq

ftp://rtfm.mit.edu/pub/faqs/computer-security/most-common-qs

I've managed to compile Tripwire and pass all the tests.
Now when I run tripwire -initialize, however, I get a segmentation fault:

root: /mnt/floppy/bin% ./tripwire -initialize
### Phase 1:   Reading configuration file
### Phase 2:   Generating file list
### Phase 3:   Creating file information database
Segmentation fault

I'm running Linux RH5.0. I'm not sure if this is related, but Tripwire also
does not seem to be following by DATABASE_PATH. I edited my include/config.h
to have these two lines:

#define CONFIG_PATH     "/mnt/floppy/tcheck"
#define DATABASE_PATH   "/mnt/floppy/tcheck/databases"

yet Tripwire seems to be creating the directory and file

/mnt/floppy/bin/databases/tw.db_alanho.student.princeton.edu

(I compiled tripwire to place the binary in /mnt/floppy/bin). On the other
hand, Tripwire does seem to be finding my tw.config, which is in
/mnt/floppy/tcheck.

 Below is my tw.config; Any help or suggestions would be greatly appreciated.

Thanks very much.
Alan

----------------------------------------------------------------------
# $Id: tw.conf.linux,v 1.1 1994/04/04 00:34:03 gkim Exp $
#
# tripwire.config for linux machines
#   (minimal version)

#      
#
# Define a variable for searching /dev

#
# All Files
#
/ R
#
# Except /proc
#
=/proc E
#
# And /dev
#

#
# just /tmp
#
=/tmp
#
#/mnt/floppy/ R
# End
#

won't be setting up mail until after Tripwire...)

Thanks,
Alan

Quote:>I'm running Linux RH5.0. I'm not sure if this is related, but Tripwire also
>does not seem to be following by DATABASE_PATH. I edited my include/config.h
>to have these two lines:

>#define CONFIG_PATH     "/mnt/floppy/tcheck"
>#define DATABASE_PATH   "/mnt/floppy/tcheck/databases"

>yet Tripwire seems to be creating the directory and file

>/mnt/floppy/bin/databases/tw.db_alanho.student.princeton.edu

Greetings
Marc

--
-------------------------------------- !! No courtesy copies, please !! -----
Marc Haber          |   " Questions are the         | Mailadresse im Header
Karlsruhe, Germany  |     Beginning of Wisdom "     | Fon: *49 721 966 32 15
Nordisch by Nature  | Lt. Worf, TNG "Rightful Heir" | Fax: *49 721 966 31 29

Quote:>> Thanks to a recent posting and a reference to the vfaq

>> ftp://rtfm.mit.edu/pub/faqs/computer-security/most-common-qs

>> I've managed to compile Tripwire and pass all the tests.  Now when
>> I run tripwire -initialize, however, I get a segmentation fault:

>> root: /mnt/floppy/bin% ./tripwire -initialize
>> ### Phase 1: Reading configuration file Phase 2: Generating file
>> ### list Phase 3: Creating file information database
>> Segmentation fault

This patch might help:

------------------------- tripwire.config.patch ----------------------------
--- config.parse.c.orig Wed Jul 20 20:03:26 1994

     /* clean up */
     if (!specified_configmode)
        (void) fclose(fpin);
-
-    rewind(fpout);
+    else {
+       /* Bug fix:  fpin and fpout are the same. fpout was being */
+       /* rewound after fpin was being closed.  The behavior of  */
+       /* this is undefined, and causes core dumps occasionally. */
+       /* Added the else and changed fpout to fpin for clarity.  */

+       rewind(fpin);
+    }
     return;
 }

--
Kevin Fenzi

http://scrye.com/~kevin/

Greetings
Marc

--
-------------------------------------- !! No courtesy copies, please !! -----
Marc Haber          |   " Questions are the         | Mailadresse im Header
Karlsruhe, Germany  |     Beginning of Wisdom "     | Fon: *49 721 966 32 15
Nordisch by Nature  | Lt. Worf, TNG "Rightful Heir" | Fax: *49 721 966 31 29

Greetings
Marc

--
-------------------------------------- !! No courtesy copies, please !! -----
Marc Haber          |   " Questions are the         | Mailadresse im Header
Karlsruhe, Germany  |     Beginning of Wisdom "     | Fon: *49 721 966 32 15
Nordisch by Nature  | Lt. Worf, TNG "Rightful Heir" | Fax: *49 721 966 31 29

Havn't tried it on any other OS's yet.

--

       Unix SysAdmin / BOFH | The way things ought to be.
http://www.xnet.com/~drwho/ | "User error: replace user and reboot"

Other operating systems might not have as much trouble because they either
don't use or don't support 8 bit characters in filenames, or because
different architecture makes the bugs non fatal.

One day I'll get around to sending the patches to whoever is maintaining
tripwire..

I got the same problem after upgrading to RedHat 5.1.

It appears that TripWire crashes when trying to access files with
unusual characters in their names. On the RedHat system, the file
that crashed tw was a cyrillic support file or something like that.

I had no time to patch tripwire to accept those files, but it should
be fairly easy to do.

the temporary workaround is to run tripwire in verbose mode and see
which file crashes tw, and remove the given file.

Bye,

Nicolas