对于tripwire，如何仅在发现违规行为时通过电子邮件发送报告

Question

我对tripwire报告的理想解决方案是：

• 仅在发现违规时才会生成每日电子邮件

• 每个星期天，无论是否发现违规行为，都会通过电子邮件发送报告

我也对 SF'ers 关于实现这一点的意见感兴趣。也许这违背了绊线的目的？我想我可以看到有人提出这样的论点。

Answer 1

我从许多主机获取大量tripwire报告的解决方案是将它们全部发送到一个将它们堆叠在文件中的地址，然后对它们运行一个简单的作业，仅报告主机名和违规计数，并且仅报告是否有任何主机的违规计数不为零的电子邮件。

首先，所有主机将报告发送到该地址tripwire@company.com。这很容易从每个 crontab 条目中进行安排；我这样做：

# check the tripwires
MAILTO=tripwire@company.com
3 1 * * *  /usr/sbin/tripwire --check

其次，在邮件服务器上，我有一个别名条目，上面写着：

# tripwire report autoprocessing
tripwire:   /var/tmp/tripwire

第三，我有一个每天早上运行以处理该文件内容的 cron 作业，另一个每天晚上运行以删除它（所以我只查看最近的输出）：

# report problems with nightly tripwire runs
2 7 * * *  /usr/local/bin/tripwire-check
45 23 * * *  rm -f /var/tmp/tripwire

这是 /usr/local/bin/tripwire-check 的内容；这很简单：

#!/bin/tcsh
grep "Total violation" /var/tmp/tripwire | grep -vw 0 > /dev/null || exit 0
egrep 'Host name|Total vio' /var/tmp/tripwire | mail -s "NIGHTLY TRIPWIRE VIOLATIONS `date +%Y%m%d`" my-real-address@company.com

第一个 grep 退出，没有任何邮件或输出 IFO 所有包含违规计数的行也包含数字 0，作为一个整体；第二个，仅在第一行失败时调用，生成简洁的摘要电子邮件并将其发送给我。

最后，这是报告错误时的示例输出：

Subject: NIGHTLY TRIPWIRE VIOLATIONS 20050401
Date:   Fri, 1 Apr 2005 07:02:00 +0100
To:     the-real-me@company.com
From:   root <root@company.com>

Host name: fw03b.company.com
Total violations found: 0
Host name: je01b.company.com
Total violations found: 0
Host name: ms01.company.com
Total violations found: 1
Host name: fw05a.company.com
Total violations found: 0
Host name: fw02b.company.com
Total violations found: 0
Host name: fw01b.company.com
Total violations found: 0
Host name: je02o.company.com
Total violations found: 0
Host name: je01a.company.com
Total violations found: 0
Host name: fw04a.company.com
Total violations found: 0
Host name: fw04b.company.com
Total violations found: 0
Host name: je02p.company.com
Total violations found: 0
Host name: fw02a.company.com
Total violations found: 0
Host name: fw03a.company.com
Total violations found: 0
Host name: rp01a.company.com
Total violations found: 0
Host name: rp01b.company.com
Total violations found: 0
Host name: je03o.company.com
Total violations found: 0
Host name: db03.company.com
Total violations found: 0
Host name: lb02p.company.com
Total violations found: 15
Host name: rp02o.company.com
Total violations found: 23
Host name: as05.company.com
Total violations found: 0
Host name: db02.company.com
Total violations found: 0

希望这有点用。