On Mon, 29 Dec 2003, Rick Stevens wrote: > Geffrey Velásquez [Minag] wrote: > > Friends, how could I change the sender of the email notification of tripwire > > 2.3? by default is: tripwire@hostname but it causes some problems... > > You could tweak the MAILPROGRAM= variable in twcfg.txt to include a > different envelope sender by using the "-f user@domain" option. Beyond > that, I think it's built into the binary. One simple option is to add an alias in /etc/aliases that redirects the mail as you wish. However I see comments in the base line twpol.txt/ twpol.txt.rpmnew file: # Email support is not included and must be added to this file. # Add the 'emailto=' to the rule directive section of each rule (add a comma # after the 'severity=' line and add an 'emailto=' and include the email # addresses you want the violation reports to go to). Addresses are # semi-colon delimited. And if I recall the policy text file must be regenerated for tripwire to accept changes. The policy will commonly have been updated (see tripwire --update --twrfile ....) i.e. RTFM look for "twadmin --create-cfgfile" and the like. tripwire will be selective with changes so again RTFM. The man page for "twconfig" notes the global variable GLOBALEMAIL. Scanning notes in a handy source pile there were some comments on bugs where apparently at least one rule with "emailto=" is needed. Your version may not have this issue. Perhaps you are looking at the tripwire report mail sent by cron or anacron, /etc/cron.daily.... if so then the your question is how to redirect mail from a specific cron job run by root but the mail goes to 'bob'. Is it? -- T o m M i t c h e l l mitch48 -a*t- yahoo-dot-com
