Tripwire: Notifikasi e-mail - Revision history

Onnowpurbo at 00:28, 25 January 2011

2011-01-25T00:28:26Z

← Older revision		Revision as of 00:28, 25 January 2011
Line 11:		Line 11:
	)		)

	~~Setelah selesai dimasukan lakukan~~		encrypt policy

	~~tripwire -m p~~ /etc/tripwire~~/twpol.txt~~		cd /etc/tripwire
			twadmin --create-polfile --cfgfile ./tw.cfg --site-keyfile ./site.key ./twpol.txt
	~~atau~~

	twadmin -~~m P~~ -e /~~etc~~/~~tripwire~~/twpol.txt

	==Konfigurasi SMTP Server==		==Konfigurasi SMTP Server==
Line 32:		Line 29:
	SMTPPORT =25		SMTPPORT =25

	~~Update file configurasi tripwire~~		encrypt konfigurasi

	twadmin -~~m F~~ -e /~~etc~~/~~tripwire~~/twcfg.txt		cd /etc/tripwire
			twadmin --create-cfgfile --cfgfile ./tw.cfg --site-keyfile ./site.key ./twcfg.txt

	==Test e-mail message==		==Test e-mail message==

	Untuk mentest notifikasi e-mail kita dapat mengunakan perintah berikut		Untuk mentest notifikasi [[e-mail]] kita dapat mengunakan perintah berikut

	/usr/sbin/tripwire --test --email your@email.address		/usr/sbin/tripwire --test --email your@email.address

Onnowpurbo: /* Konfigurasi SMTP Server */

2011-01-24T03:38:36Z

Konfigurasi SMTP Server

← Older revision		Revision as of 03:38, 24 January 2011
Line 29:		Line 29:
	MAILMETHOD =SMTP		MAILMETHOD =SMTP
	SMTPHOST =smtp.telkom.net		SMTPHOST =smtp.telkom.net
			SMTPHOST =222.124.18.79 (kalau mau aman)
	SMTPPORT =25		SMTPPORT =25

Line 34:		Line 35:

	twadmin -m F -e /etc/tripwire/twcfg.txt		twadmin -m F -e /etc/tripwire/twcfg.txt


	==Test e-mail message==		==Test e-mail message==

Onnowpurbo at 03:37, 24 January 2011

2011-01-24T03:37:01Z

← Older revision		Revision as of 03:37, 24 January 2011
Line 15:		Line 15:
	tripwire -m p /etc/tripwire/twpol.txt		tripwire -m p /etc/tripwire/twpol.txt

			atau

			twadmin -m P -e /etc/tripwire/twpol.txt

	==Konfigurasi SMTP Server==		==Konfigurasi SMTP Server==
Line 27:		Line 30:
	SMTPHOST =smtp.telkom.net		SMTPHOST =smtp.telkom.net
	SMTPPORT =25		SMTPPORT =25

			Update file configurasi tripwire

			twadmin -m F -e /etc/tripwire/twcfg.txt


	==Test e-mail message==		==Test e-mail message==

Onnowpurbo at 03:22, 24 January 2011

2011-01-24T03:22:01Z

← Older revision		Revision as of 03:22, 24 January 2011
Line 15:		Line 15:
	tripwire -m p /etc/tripwire/twpol.txt		tripwire -m p /etc/tripwire/twpol.txt


			==Konfigurasi SMTP Server==

			Edit

			vi /etc/tripwire/twcfg.txt

			Pastikan misalnya

			MAILMETHOD =SMTP
			SMTPHOST =smtp.telkom.net
			SMTPPORT =25

	==Test e-mail message==		==Test e-mail message==

Onnowpurbo at 03:16, 24 January 2011

2011-01-24T03:16:42Z

← Older revision		Revision as of 03:16, 24 January 2011
Line 10:		Line 10:
	emailto = bob@domain.com;sam@domain.com		emailto = bob@domain.com;sam@domain.com
	)		)

			Setelah selesai dimasukan lakukan

			tripwire -m p /etc/tripwire/twpol.txt

Onnowpurbo at 03:13, 24 January 2011

2011-01-24T03:13:49Z

← Older revision		Revision as of 03:13, 24 January 2011
Line 1:		Line 1:
	Tripwire ~~and Email~~		Kita dapat melaporkan kejadian menggunakan tripwire dan ini harus ditulis pada file Tripwire

	Tripwire can email someone if a specific type of rule in the policy file is violated. To configure Tripwire to do this, you first have to know the email address of the person to be contacted if a particular integrity violation occurs, plus the name of the rule you would like to monitor. Note that on large systems with multiple administrators, you can have different sets of people notified for certain violations and no one notified for minor violations.		/etc/tripwire/twpol.txt

	~~Once you know who to notify and what to notify them about, add an emailto= line to the rule directive section of each rule~~. Do this by adding a comma after the severity= line and putting emailto= on the next line, followed by the email addresses to send the violation reports for that rule. Multiple emails will be sent if more than one email address is specified and they are separated by a semi-colon.		contoh e-mail admin bob@domain.com;sam@domain.com

	~~For example, if you would like two administrators, Sam and Bob~~, ~~notified if a networking program is modified~~, ~~change the Networking Programs rule directive in the policy file to look like this:~~		(
			rulename = "Networking Programs",
			severity = $(SIG_HI),
			emailto = bob@domain.com;sam@domain.com
			)

	(
	~~rulename = "Networking Programs",~~
	~~severity = $(SIG_HI),~~
	~~emailto = bob@domain.com;sam@domain.com~~
	)

	Once a new signed policy file is generated from the /etc/tripwire/twpol.txt file, the specified email addresses will be notified upon violations of that particular rule. For instructions on signing your policy file, see the section called Updating the Policy File.		==Test e-mail message==
	~~Sending~~ Test ~~Email Messages~~

	~~To make sure that Tripwire's email notification configuration can actually send email correctly, use the following command:~~		Untuk mentest notifikasi e-mail kita dapat mengunakan perintah berikut

	/usr/sbin/tripwire --test --email your@email.address		/usr/sbin/tripwire --test --email your@email.address

	~~A test email will immediately be sent to the email address by the tripwire program.~~

			Test [[e-mail]] akan dikirim langsung ke e-mail address oleh tripwire

	==Referensi==		==Referensi==

Onnowpurbo: New page: Tripwire and Email Tripwire can email someone if a specific type of rule in the policy file is violated. To configure Tripwire to do this, you first have to know the email address of the ...

2011-01-24T03:09:55Z

New page: Tripwire and Email Tripwire can email someone if a specific type of rule in the policy file is violated. To configure Tripwire to do this, you first have to know the email address of the ...

New page

Tripwire and Email

Tripwire can email someone if a specific type of rule in the policy file is violated. To configure Tripwire to do this, you first have to know the email address of the person to be contacted if a particular integrity violation occurs, plus the name of the rule you would like to monitor. Note that on large systems with multiple administrators, you can have different sets of people notified for certain violations and no one notified for minor violations.

Once you know who to notify and what to notify them about, add an emailto= line to the rule directive section of each rule. Do this by adding a comma after the severity= line and putting emailto= on the next line, followed by the email addresses to send the violation reports for that rule. Multiple emails will be sent if more than one email address is specified and they are separated by a semi-colon.

For example, if you would like two administrators, Sam and Bob, notified if a networking program is modified, change the Networking Programs rule directive in the policy file to look like this:

(
rulename = "Networking Programs",
severity = $(SIG_HI),
emailto = bob@domain.com;sam@domain.com
)

Once a new signed policy file is generated from the /etc/tripwire/twpol.txt file, the specified email addresses will be notified upon violations of that particular rule. For instructions on signing your policy file, see the section called Updating the Policy File.
Sending Test Email Messages

To make sure that Tripwire's email notification configuration can actually send email correctly, use the following command:

/usr/sbin/tripwire --test --email your@email.address

A test email will immediately be sent to the email address by the tripwire program.

==Referensi==

* http://www.centos.org/docs/2/rhl-rg-en-7.2/s1-tripwire-email.html

==Pranala Menarik==

* [[Tripwire: Notifikasi e-mail]]
* [[Keamanan Jaringan]]
* [[OS Security]]

[[Category: network security]]