Tripwire
From charlesreid1
Overview
What is it?
Tripwire is an open-source program that monitors file integrity. It performs a check of the filesystem state against a known baseline state, and alerts on changes that are detected.
Tripwire can monitor file contents, but also permissions, ownership, or directories.
Installing
Tripwire is a bit of a pain to install in an automated way, because it wants to try and walk you through a few initial setup steps.
We cover automated installation below.
Manual Installation
Install Tripwire using aptitude, since it is present in the official Debian repositories:
sudo apt-get -y update sudo apt-get -y install tripwire
This will present several interactive prompts for the mulit-step setup process.
The steps are described on the Tripwire Readme: https://github.com/Tripwire/tripwire-open-source
Automated Installation
This SO answer gives some help, but this Unix SE answer is also needed. Here's the final incantation:
sudo DEBIAN_FRONTEND=noninteractive apt-get -y install tripwire
This should install tripwire with zero user intervention required.
Automated Setup Details
Some details about what happens and where things go when setup is automated...
Automated Key Creation
The Tripwire setup process sets up two different keys:
- site key - the key used to secure the configuration file (if the configuration file is compromised, all findings from tripwire are suspect); this can be used across multiple servers just as config files can be
- local key - the key used on each machine to run the binary (ensures binary does not run without owner's consent)
These keys can be protected with a passphrase if Tripwire is being set up manually, but the automated installation process will not put any passphrase in place.
Automated installation will put the keys here:
/etc/tripwire/HOSTNAME-local.key- this is the automatically generated local key/etc/tripwire/site.key- this is the automatically generated site key
Policy and Config Files
Note that the policy and configuration files that are created have two versions: the actual policy/config file (which is encrypted using the site key), and the plain text version.
The automated installation has the default encrypted policy file at <code/etc/tripwire/tw.pol and the plain text version at:
/etc/tripwire/twpol.txt
The automated installation has the default encrypted config file at <code/etc/tripwire/tw.cfg and the plain text version at:
/etc/tripwire/twcfg.txt
Initializing the Database
There is yet another manual step that must be run to scan the filesystem and prepare the database (I guess this is creating the baseline??)
To initialize the database:
sudo tripwire --init
This interactively prompts the user for the local key passphrase (these Tripwire people are REALLY trying to make life harder for automation-centric folks, huh?)
Use the -P my_passphrase or --local-passphrase my_passphrase flag to specify these on the CLI - they should be empty strings if using automated setup
Scanning and Updating Policy File
The general procedure to make your policy file useful is to use tripwire to generate a list of findings first, then update the policy file to eliminate false positives.
Scanning
To run a scan and generate findings:
sudo sh -c 'tripwire --check | grep Filename > test_results'
Now review the findings in test_results and figure out which ones are false positives. Then update the policy file to remove rules that generate false positives.
Updating the Policy File
Update the policy file to adjust the rules:
vim /etc/tripwire/twpol.txt
Once you are finished, generate a new encrypted policy file from the unencrypted plain text policy file:
sudo twadmin --create-polfile /etc/tripwire/twpol.txt
Links
excellent digital ocean guide: https://www.digitalocean.com/community/tutorials/how-to-use-tripwire-to-detect-server-intrusions-on-an-ubuntu-vps
automated installation of tripwire with puppet: https://github.com/autostructure/tripwire
Flags
