Difference between revisions of "Tripwire"

From OnnoWiki
Jump to navigation Jump to search
Line 1: Line 1:
 +
Tripwire on Ubuntu Linux
 +
 +
The idea behind tripwire is to create a baseline database of the state of the the files and directories on your system, then you run tripwire daily and it compares the current state with the baseline state, you will then be warned of any unauthorised deletions, additions, or changes to your filesystem. A policy file decides what files and directories are to be checked, and what attributes to compare, e.g., inode and modification timestamps, owner and group IDs, file size, permission and MD5/SHA hash values etc.
 +
 +
 +
Installing Tripwire
 +
 +
To install tripwire on Ubuntu, simply issue the command -:
 +
 +
[root@home /etc/tripwire]# apt-get install tripwire
 +
 +
Apt will then go off and install the required packages on your system and begin the tripwire configuration process. You will be asked for a passphrase for each of the local and site keys; it should be greater than 8 characters and include punctuation symbols as well as alphanumeric characters.
 +
 +
Do not leave the plain-text versions of the configuration and policy files on your hard drive. Move them onto a floppy disk or encrypt them using a utility such as GPG. Also ensure that the permissions of the signed files are set such that they are only readable/writeable by root:
 +
 +
[root@home /etc/tripwire]# chmod 0600 tw.cfg tw.pol
 +
 +
Editing the Policy
 +
 +
You will want to edit the default policy, check out the twpol.txt file in /etc/tripwire and comment out any files or folders you do not want to be checked. Once you have done this run the following command -:
 +
 +
[root@home /etc/tripwire]# twadmin --create-polfile --cfgfile ./tw.cfg --site-keyfile \
 +
./site.key ./twpol.txt
 +
 +
Initialising the database
 +
 +
You can initialise the baseline database of your system by running -:
 +
 +
[root@home /etc/tripwire]# tripwire --init --cfgfile /etc/tripwire/tw.cfg \
 +
--polfile /etc/tripwire/tw.pol --site-keyfile /etc/tripwire/site.key \
 +
--local-keyfile /etc/tripwire/HOSTNAME-local.key
 +
 +
Tripwire will ask for your local passphrase then start to build the baseline database of your system. This can take a little while so be patient and go make a cup of tea.
 +
System Checks
 +
 +
[root@home /etc/tripwire]# tripwire --check
 +
 +
Each violation (an addition, removal or change) is reported to stdout and written to the report file as indicated. On this occasion I have assumed the default locations of the configuration and policy files. I could have specified these explicitly on the command line as I have been doing with switches such as --cfgfile, etc.
 +
 +
Your goal should be to set this up to run on a daily basis. This can be done as a cron or an Anacron job; Anacron is the better choice when the computer is not on 24/7. Using either cron or Anacron, the output should be e-mailed to the root user on each run of Tripwire.
 +
 +
Updating the policy
 +
 +
If you update your policy, for example to exclude directories from the scan, then the tripwire command has a policy update mode which means that a change in policy does not require us to reinitialise the database. The policy update mode simply synchronises the existing database with the new policy file. The new policy file expected is the plain-text version - Tripwire will then ask for the local and site passphrases, synchronise the database and sign both the new policy file and the database.
 +
 +
[root@home /etc/tripwire]# tripwire --update-policy --cfgfile ./tw.cfg --polfile ./tw.pol \
 +
--site-keyfile ./site.key --local-keyfile ./HOSTNAME-local.key ./twpol.txt
 +
 +
Regular Updates
 +
 +
You will also need to do regular updates to keep your database current with your file system.  Do the checks and examine the before making updates.  Perform updates regularly (determine your schedule) and also after making any major changes to the file architecture.
 +
 +
[root@home /etc/tripwire]# tripwire --update -Z low   
 +
 +
This command will compare your database against your current file system and then launch an editor so that you can choose to make changes to your database.
 +
 +
 +
If you try this command but get an error message about a missing report file, the reason is most likely that the last check was not run immediately prior to the update.  The report file in the /var/lib/tripwire/report directory is named by hostname, then date (yyyymmdd) then time.  If you have recently run a check and want the update to proceed using your most recent report file, then use the -r option and provide the report filename that you want the update to use.
 +
 +
[root@home /etc/tripwire]# tripwire --update -Z low --twrfile host-yyyymmdd-tttttt.twr   
 +
 +
 +
 +
 
instalasi
 
instalasi
  
Line 15: Line 79:
 
  tripwire -m p /etc/tripwire/twpol.txt
 
  tripwire -m p /etc/tripwire/twpol.txt
  
 +
 +
==Local Manual==
 +
 +
/usr/share/doc/tripwire/README.Debian
  
 
==Referensi==
 
==Referensi==
  
−
/usr/share/doc/tripwire/README.Debian
+
* http://remoteadmin.org.uk/tutorials/42-linux/56-tripwire-ubuntu
 +
* http://www.ubuntu-unleashed.com/2007/08/protecting-your-ubuntu-machine.html
 +
* http://www.ubuntugeek.com/list-of-security-tools-available-in-ubuntu.html
  
 
==Pranala Menarik==
 
==Pranala Menarik==

Revision as of 10:46, 24 January 2011

Tripwire on Ubuntu Linux

The idea behind tripwire is to create a baseline database of the state of the the files and directories on your system, then you run tripwire daily and it compares the current state with the baseline state, you will then be warned of any unauthorised deletions, additions, or changes to your filesystem. A policy file decides what files and directories are to be checked, and what attributes to compare, e.g., inode and modification timestamps, owner and group IDs, file size, permission and MD5/SHA hash values etc.


Installing Tripwire

To install tripwire on Ubuntu, simply issue the command -:

[root@home /etc/tripwire]# apt-get install tripwire

Apt will then go off and install the required packages on your system and begin the tripwire configuration process. You will be asked for a passphrase for each of the local and site keys; it should be greater than 8 characters and include punctuation symbols as well as alphanumeric characters.

Do not leave the plain-text versions of the configuration and policy files on your hard drive. Move them onto a floppy disk or encrypt them using a utility such as GPG. Also ensure that the permissions of the signed files are set such that they are only readable/writeable by root:

[root@home /etc/tripwire]# chmod 0600 tw.cfg tw.pol

Editing the Policy

You will want to edit the default policy, check out the twpol.txt file in /etc/tripwire and comment out any files or folders you do not want to be checked. Once you have done this run the following command -:

[root@home /etc/tripwire]# twadmin --create-polfile --cfgfile ./tw.cfg --site-keyfile \ ./site.key ./twpol.txt

Initialising the database

You can initialise the baseline database of your system by running -:

[root@home /etc/tripwire]# tripwire --init --cfgfile /etc/tripwire/tw.cfg \ --polfile /etc/tripwire/tw.pol --site-keyfile /etc/tripwire/site.key \ --local-keyfile /etc/tripwire/HOSTNAME-local.key

Tripwire will ask for your local passphrase then start to build the baseline database of your system. This can take a little while so be patient and go make a cup of tea. System Checks

[root@home /etc/tripwire]# tripwire --check

Each violation (an addition, removal or change) is reported to stdout and written to the report file as indicated. On this occasion I have assumed the default locations of the configuration and policy files. I could have specified these explicitly on the command line as I have been doing with switches such as --cfgfile, etc.

Your goal should be to set this up to run on a daily basis. This can be done as a cron or an Anacron job; Anacron is the better choice when the computer is not on 24/7. Using either cron or Anacron, the output should be e-mailed to the root user on each run of Tripwire.

Updating the policy

If you update your policy, for example to exclude directories from the scan, then the tripwire command has a policy update mode which means that a change in policy does not require us to reinitialise the database. The policy update mode simply synchronises the existing database with the new policy file. The new policy file expected is the plain-text version - Tripwire will then ask for the local and site passphrases, synchronise the database and sign both the new policy file and the database.

[root@home /etc/tripwire]# tripwire --update-policy --cfgfile ./tw.cfg --polfile ./tw.pol \ --site-keyfile ./site.key --local-keyfile ./HOSTNAME-local.key ./twpol.txt

Regular Updates

You will also need to do regular updates to keep your database current with your file system. Do the checks and examine the before making updates. Perform updates regularly (determine your schedule) and also after making any major changes to the file architecture.

[root@home /etc/tripwire]# tripwire --update -Z low

This command will compare your database against your current file system and then launch an editor so that you can choose to make changes to your database.


If you try this command but get an error message about a missing report file, the reason is most likely that the last check was not run immediately prior to the update. The report file in the /var/lib/tripwire/report directory is named by hostname, then date (yyyymmdd) then time. If you have recently run a check and want the update to proceed using your most recent report file, then use the -r option and provide the report filename that you want the update to use.

[root@home /etc/tripwire]# tripwire --update -Z low --twrfile host-yyyymmdd-tttttt.twr



instalasi 

apt-get install tripwire

Enter site key passphrase
Enter local key passphrase

Konfigurasi 

/etc/tripwire


Update policy 

tripwire -m p /etc/tripwire/twpol.txt


Local Manual

/usr/share/doc/tripwire/README.Debian

Referensi

Pranala Menarik

Retrieved from "https://onnocenter.or.id/wiki/index.php?title=Tripwire&oldid=24765"