# $Id$
#
# tripwire.config
# Generic version for HP/UX
#	
#	Joe Polcari <jpolcari@galaxy.prime.com>
#
# This file contains a list of files and directories that System 
# Preener will scan.  Information collected from these files will be 
# stored in the tripwire.database file.
#
# Format: 			[!|=] entry [ignore-flags]
#
# where:	 '!' signifies the entry is to be pruned (inclusive) from
#				the list of files to be scanned.
#		 '=' signifies the entry is to be added, but if it is
#				a directory, then all its contents are pruned
#				(useful for /tmp).
#
# where:	entry is the absolute pathname of a file or a directory
#
# where ignore-flags are in the format:
#		[template][ [+|-][pinugsam12] ... ]
#
# 	- :  ignore the following atributes
#	+ :  do not ignore the following attributes
#
#	p :  permission and file mode bits 	a: access timestamp
#	i :  inode number			m: modification timestamp
#	n :  number of links (ref count)	c: inode creation timestamp
#	u :  user id of owner			1: signature 1
#	g :  group id of owner			2: signature 2
#	s :  size of file
#
#
# Ex:   The following entry will scan all the files in /etc, and report
#	any changes in mode bits, inode number, reference count, uid,
#	gid, modification and creation timestamp, and the signatures.
#	However, it will ignore any changes in the access timestamp.
#
#	/etc	+pinugsm12-a
#
# The following templates have been pre-defined to make these long ignore
# mask descriptions unecessary.
#
# Templates: 	(default)	R :  [R]ead-only (+pinugsm12-a)
#				L :  [L]og file (+pinug-sam12)
#				N :  ignore [N]othing (+pinusgsamc12)
#				E :  ignore [E]verything (-pinusgsamc12)
#
# By default, Tripwire uses the R template -- it ignores
# only the access timestamp.
#
# You can use templates with modifiers, like:
#	Ex:  /etc/lp	E+ug
#
#	Example configuration file:
#		/etc		R	# all system files
#		!/etc/lp	R	# ...but not those logs
#		=/tmp		N	# just the directory, not its files
#
# Note the difference between pruning (via "!") and ignoring everything
# (via "E" template):  Ignoring everything in a directory still monitors
# for added and deleted files.  Pruning a directory will prevent Tripwire
# from even looking in the specified directory.
#
#
# Tripwire running slowly?  Modify your tripwire.config entries to
# ignore the (signature 2) attribute when this computationally-exorbitant 
# protection is not needed.  (See README and design document for further
# details.)
#
#  First, root's "home"
=/		L
/.rhosts	R	# may not exist
/.profile	R	# may not exist
/.cshrc		R	# may not exist
/.login		R	# may not exist
#/.exrc		R	# may not exist
/.logout	R	# may not exist
#/.emacs		R	# may not exist
/.forward	R	# may not exist
#/.netrc		R	# may not exist
/.defaults	R
/.suntools	R
/.mailrc	R
/.kermrc	R
/.newsrc	R

# Unix itself
/vmunix		R

# Now, some critical directories and files
#  Some exceptions are noted further down
/etc		R
/etc/inetd.conf	R
/etc/rc		R
/etc/rc.boot	R
/etc/rc.local	R-2
/etc/rc.single	R
#/etc/rc.ip	R
/etc/ttytab	R
/etc/exports	R
/etc/ttys	L
/etc/dumpdates	L
/etc/mtab	L
/etc/motd	L
/etc/rmtab	L
/etc/utmp	L
/etc/group	R	# changes should be infrequent
#  The next line may need to be replaced with /etc/security
#   if C2 is enabled
/etc/passwd	L

/var		L

/dev		E

/usr/etc	R

# Checksumming the following is not so critical.  However,
#  setuid/setgid files are special-cased further down.

/lib		R-2

/bin		R-2

/usr/bin	R-2

/usr/ucb	R-2

/usr/lib	R-2

/usr1/local	R-2

/usr2/pics	E

=/usr		L
=/usr/spool	L
/usr/spool/cron		L
/usr/spool/mqueue	L
/usr/spool/mail		L

# You may or may not have the following
#/usr/ftp	L
#/usr/ftp/bin	R
#/usr/ftp/etc	R

# put entries in for /var/yp if you need it
# put entries for uucp if you need them
# put entries for /var/adm if you need it

=/tmp
=/var/tmp

#  Here are entries for setuid/setgid files.  On these, we use
#  both signatures just to be sure.
#
#  You may want/need to edit this list.  Batteries not inc.

/admin			N
/bin/at			R
/bin/atq		R
/bin/atrm		R
#/bin/cancel		R
/bin/chfn		R
/bin/chsh		R
/bin/crontab		R
/bin/cu			R
/bin/df			R
/bin/iostat		R
/bin/ipcs		R
/bin/login		R
#/bin/lpstat		R
/bin/mail		R
/bin/newgrp		R
/bin/passwd		R
/bin/su			R
#/bin/sunview1/sv_acquire		R
#/bin/sunview1/sv_release		R
#/bin/sunview1/toolplaces		R
/bin/tip		R
/bin/uucp		R
/bin/uuname		R
/bin/uustat		R
/bin/uux		R
/bin/wall		R
/bin/write		R
#/bin/ypchfn		R
#/bin/ypchsh		R
/bin/yppasswd		R
/usr/bin/at		R
/usr/bin/atq		R
/usr/bin/atrm		R
#/usr/bin/cancel		R
/usr/bin/chfn		R
/usr/bin/chsh		R
/usr/bin/crontab	R
/usr/bin/cu		R
/usr/bin/df		R
/usr/bin/iostat		R
/usr/bin/ipcs		R
/usr/bin/login		R
#/usr/bin/lpstat		R
/usr/bin/mail		R
/usr/bin/newgrp		R
/usr/bin/passwd		R
/usr/bin/su		R
#/usr/bin/sunview1/sv_acquire		R
#/usr/bin/sunview1/sv_release		R
#/usr/bin/sunview1/toolplaces		R
/usr/bin/tip		R
/usr/bin/uucp		R
/usr/bin/uuname		R
/usr/bin/uustat		R
/usr/bin/uux		R
/usr/bin/wall		R
/usr/bin/write		R
#/usr/bin/ypchfn		R
#/usr/bin/ypchsh		R
/usr/bin/yppasswd	R
/usr/etc/arp		R
#/usr/etc/chill		R
#/usr/etc/devinfo	R
/usr/etc/dkinfo		R
/usr/etc/dmesg		R
/usr/etc/dump		R
/usr/etc/dumpfs		R
/usr/etc/keyenvoy	R
/usr/etc/kgmon		R
/usr/etc/lpc		R
/usr/etc/nfsstat	R
/usr/etc/ping		R
/usr/etc/rpc.rwalld	R
/usr/etc/trpt		R
/usr/ucb/lpq		R
/usr/ucb/lpr		R
/usr/ucb/netstat	R
/usr/ucb/rcp		R
/usr/ucb/rdist		R
/usr/ucb/rlogin		R
/usr/ucb/rsh		R
/usr/ucb/talk		R
/usr/ucb/vmstat		R