Tripwire

Overview

What is it?

Tripwire is an open-source program that monitors file integrity. It performs a check of the filesystem state against a known baseline state, and alerts on changes that are detected.

Tripwire can monitor file contents, but also permissions, ownership, or directories.

Installing

Tripwire is a bit of a pain to install in an automated way, because it wants to try and walk you through a few initial setup steps.

We cover automated installation below.

Manual Installation

Install Tripwire using aptitude, since it is present in the official Debian repositories:

sudo apt-get -y update
sudo apt-get -y install tripwire

This will present several interactive prompts for the mulit-step setup process.

The steps are described on the Tripwire Readme: https://github.com/Tripwire/tripwire-open-source

Automated Installation

This SO answer gives some help, but this Unix SE answer is also needed. Here's the final incantation:

sudo DEBIAN_FRONTEND=noninteractive apt-get -y install tripwire

This should install tripwire with zero user intervention required.

Automated Setup Details

Some details about what happens and where things go when setup is automated...

Automated Key Creation

The Tripwire setup process sets up two different keys:

• site key - the key used to secure the configuration file (if the configuration file is compromised, all findings from tripwire are suspect); this can be used across multiple servers just as config files can be
• local key - the key used on each machine to run the binary (ensures binary does not run without owner's consent)

These keys can be protected with a passphrase if Tripwire is being set up manually, but the automated installation process will not put any passphrase in place.

Automated installation will put the keys here:

• /etc/tripwire/HOSTNAME-local.key - this is the automatically generated local key
• /etc/tripwire/site.key - this is the automatically generated site key

Policy and Config Files

Note that the policy and configuration files that are created have two versions: the actual policy/config file (which is encrypted using the site key), and the plain text version.

The automated installation has the default encrypted policy file at <code/etc/tripwire/tw.pol and the plain text version at:

/etc/tripwire/twpol.txt

The automated installation has the default encrypted config file at <code/etc/tripwire/tw.cfg and the plain text version at:

/etc/tripwire/twcfg.txt

Initializing the Database

There is yet another manual step that must be run to scan the filesystem and prepare the database (I guess this is creating the baseline??)

To initialize the database:

sudo tripwire --init

This interactively prompts the user for the local key passphrase (these Tripwire people are REALLY trying to make life harder for automation-centric folks, huh?)

Use the -P my_passphrase or --local-passphrase my_passphrase flag to specify these on the CLI - they should be empty strings if using automated setup

Scanning and Updating Policy File

The general procedure to make your policy file useful is to use tripwire to generate a list of findings first, then update the policy file to eliminate false positives.

Scanning

To run a scan and generate findings:

sudo sh -c 'tripwire --check | grep Filename > test_results'

Now review the findings in test_results and figure out which ones are false positives. Then update the policy file to remove rules that generate false positives.

Updating the Policy File

Update the policy file to adjust the rules:

vim /etc/tripwire/twpol.txt

Once you are finished, generate a new encrypted policy file from the unencrypted plain text policy file:

sudo twadmin --create-polfile /etc/tripwire/twpol.txt

Rules We Removed

There were a lot of false positives generated by files in the /root directory, so we removed the "Root config files" rule.

We removed the rule for /etc/rc.boot since that file was not present

We also had findings generated from files in /proc. Because we weren't interested in monitoring any of those, we also removed /proc (but not /dev) from the list of directory contents being monitored.

Links

excellent digital ocean guide: https://www.digitalocean.com/community/tutorials/how-to-use-tripwire-to-detect-server-intrusions-on-an-ubuntu-vps

automated installation of tripwire with puppet: https://github.com/autostructure/tripwire