Tripwire - Revision history

Unknown user: /* Policy and Config Files */

2022-04-01T17:35:45Z

Policy and Config Files

← Older revision		Revision as of 17:35, 1 April 2022
Line 83:		Line 83:
	Note that the policy and configuration files that are created have two versions: the actual policy/config file (which is encrypted using the site key), and the plain text version.		Note that the policy and configuration files that are created have two versions: the actual policy/config file (which is encrypted using the site key), and the plain text version.

	The automated installation has the default encrypted policy file at <code/etc/tripwire/tw.pol</code> and the plain text version at:		The automated installation has the default encrypted policy file at <code>/etc/tripwire/tw.pol</code> and the plain text version at:

	<pre>		<pre>
Line 89:		Line 89:
	</pre>		</pre>

	The automated installation has the default encrypted config file at <code/etc/tripwire/tw.cfg</code> and the plain text version at:		The automated installation has the default encrypted config file at <code>/etc/tripwire/tw.cfg</code> and the plain text version at:

	<pre>		<pre>

Unknown user at 03:24, 6 March 2022

2022-03-06T03:24:08Z

← Older revision		Revision as of 03:24, 6 March 2022
Line 316:		Line 316:

	{{KaliFlag}}		{{KaliFlag}}

			[[Category:Tripwire]]

Unknown user: /* Create New Baseline */

2022-03-06T01:26:41Z

Create New Baseline

← Older revision		Revision as of 01:26, 6 March 2022
Line 176:		Line 176:

	Now you're finally done with the manual, one-time setup process, and tripwire is ready to rock!		Now you're finally done with the manual, one-time setup process, and tripwire is ready to rock!

			===Cleaning Up===

			Tripwire has the ability to generate a plain text policy/config file from the encrypted version, just as it can create an encrypted version from a plain text version:

			<pre>
			sudo sh -c 'twadmin --print-polfile > /etc/tripwire/twpol.txt'
			</pre>

			So, if we are finally happy with the config and policy files, we can remove the plain text versions:

			<pre>
			sudo rm /etc/tripwire/twpol.txt
			</pre>

	===Rules We Removed===		===Rules We Removed===

Unknown user: /* Sample Report */

2022-03-06T01:23:49Z

Sample Report

← Older revision		Revision as of 01:23, 6 March 2022
Line 228:		Line 228:
	===============================================================================		===============================================================================

	Host name: ~~ANDROID~~		Host name: basilisk
	Host IP address: 127.0.1.1		Host IP address: 127.0.1.1
	Host ID: None		Host ID: None
	Policy file used: /etc/tripwire/tw.pol		Policy file used: /etc/tripwire/tw.pol
	Configuration file used: /etc/tripwire/tw.cfg		Configuration file used: /etc/tripwire/tw.cfg
	Database file used: /var/lib/tripwire/~~ANDROID~~.twd		Database file used: /var/lib/tripwire/basilisk.twd
	Command line used: tripwire --check		Command line used: tripwire --check

Unknown user: /* Running */

2022-03-06T01:23:06Z

Running

← Older revision		Revision as of 01:23, 6 March 2022
Line 199:		Line 199:
	</pre>		</pre>

	This will generate a text report. Here is an example report:		This will generate a text report. This output can be redirected to a file to create a report file that can be managed with a log file manager or something.

			==Sample Report==

			Here is an example report:

	<pre>		<pre>

Unknown user: /* Setup */

2022-03-06T01:22:17Z

Setup

← Older revision		Revision as of 01:22, 6 March 2022
Line 190:		Line 190:

	(Once we removed the rules for /root and /proc, the scans went much faster.)		(Once we removed the rules for /root and /proc, the scans went much faster.)

			=Running=

			Once you've gone through the pain of setting it up, tripwire is pretty easy to run:

			<pre>
			sudo tripwire --check
			</pre>

			This will generate a text report. Here is an example report:

			<pre>
			$ sudo tripwire --check
			[sudo] password for basilisk:
			Parsing policy file: /etc/tripwire/tw.pol
			* Processing Unix File System *
			Performing integrity check...
			The object: "/dev/hugepages" is on a different file system...ignoring.
			The object: "/dev/mqueue" is on a different file system...ignoring.
			The object: "/dev/pts" is on a different file system...ignoring.
			The object: "/dev/shm" is on a different file system...ignoring.
			Wrote report file: /var/lib/tripwire/report/ANDROID-20220305-170624.twr


			Open Source Tripwire(R) 2.4.3.7 Integrity Check Report

			Report generated by: root
			Report created on: Sat 05 Mar 2022 05:06:24 PM PST
			Database last updated on: Never

			===============================================================================
			Report Summary:
			===============================================================================

			Host name: ANDROID
			Host IP address: 127.0.1.1
			Host ID: None
			Policy file used: /etc/tripwire/tw.pol
			Configuration file used: /etc/tripwire/tw.cfg
			Database file used: /var/lib/tripwire/ANDROID.twd
			Command line used: tripwire --check

			===============================================================================
			Rule Summary:
			===============================================================================

			-------------------------------------------------------------------------------
			Section: Unix File System
			-------------------------------------------------------------------------------

			Rule Name Severity Level Added Removed Modified
			--------- -------------- ----- ------- --------
			Other binaries 66 0 0 0
			Tripwire Binaries 100 0 0 0
			Other libraries 66 0 0 0
			Root file-system executables 100 0 0 0
			Tripwire Data Files 100 0 0 0
			System boot changes 100 0 0 0
			Root file-system libraries 100 0 0 0
			(/lib)
			Critical system boot files 100 0 0 0
			Other configuration files 66 0 0 0
			(/etc)
			Boot Scripts 100 0 0 0
			Security Control 66 0 0 0
			Devices & Kernel information 100 0 0 0
			(/dev)
			Invariant Directories 66 0 0 0

			Total objects scanned: 91409
			Total violations found: 0

			===============================================================================
			Object Summary:
			===============================================================================

			-------------------------------------------------------------------------------
			# Section: Unix File System
			-------------------------------------------------------------------------------

			No violations.

			===============================================================================
			Error Report:
			===============================================================================

			No Errors

			-------------------------------------------------------------------------------
			* End of report *

			Open Source Tripwire 2.4 Portions copyright 2000-2018 Tripwire, Inc. Tripwire is a registered
			trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;
			for details use --version. This is free software which may be redistributed
			or modified only under certain conditions; see COPYING for details.
			All rights reserved.
			Integrity check complete.
			</pre>

	=Links=		=Links=

Unknown user: /* Perform a Scan */

2022-03-06T00:50:21Z

Perform a Scan

← Older revision		Revision as of 00:50, 6 March 2022
Line 131:		Line 131:
	===Perform a Scan===		===Perform a Scan===

	To run a scan and generate findings:		To run a scan and generate findings (note that we are only looking for "Filename" here because this is just the initial scan where we're trying to eliminate false positive findings!):

	<pre>		<pre>

Unknown user at 00:48, 6 March 2022

2022-03-06T00:48:54Z

← Older revision		Revision as of 00:48, 6 March 2022
Line 6:		Line 6:

	Tripwire can monitor file contents, but also permissions, ownership, or directories.		Tripwire can monitor file contents, but also permissions, ownership, or directories.

			=Setup=

	==Installing==		==Installing==

Unknown user: /* Create New Baseline */

2022-03-06T00:48:35Z

Create New Baseline

← Older revision		Revision as of 00:48, 6 March 2022
Line 172:		Line 172:
	sudo tripwire --init -P ""		sudo tripwire --init -P ""
	</pre>		</pre>

			Now you're finally done with the manual, one-time setup process, and tripwire is ready to rock!

	===Rules We Removed===		===Rules We Removed===

Unknown user: /* Create New Baseline */

2022-03-06T00:48:03Z

Create New Baseline

← Older revision		Revision as of 00:48, 6 March 2022
Line 170:		Line 170:

	<pre>		<pre>
	tripwire --init		sudo tripwire --init -P ""
	</pre>		</pre>


	===Rules We Removed===		===Rules We Removed===