Tripwire is a tool that keeps a database of information about files on the server. It performs regular checks and reports about files that have been changed, deleted, created, or renamed.

Tripwire is run from /etc/cron.daily/tripwire with the following command line:

/usr/sbin/tripwire --check --quiet

• --check causes the program to compare the current files in the system with the recorded attributes in the database and print a report to stdout

• --quiet tells it not to print the path of every file and directory that is examined

1. Configuration Files `/etc/tripwire`

• fyodor.hcoop.net-local.key is a cryptographic key used to sign the database and reports

• site.key is a cryptographic key used to sign the configuration and policy files

• tw.cfg is a signed binary file that holds configuration information

• twcfg.txt is the text source of tw.cfg

• tw.pol is a signed binary file that holds the logging and reporting policy information

• twpol.txt is the text source of tw.pol

2. Data Files `/var/lib/tripwire`

• fyodor.hcoop.net.twd is the signed tripwire database, storing information about every monitored file

• reports/ holds the signed binary reports

3. Updating the Database

The check operation creates a signed binary report file every time it runs. This report is like a "diff" of the database and the current file system. The database is updated by "patching" it with the report. Here is the procedure:

1. The command is tripwire --update

2. If it complains that the file could not be opened then you must specify the report file with the -r option. Example: tripwire --update -r /var/lib/tripwire/report/fyodor.hcoop.net-20051023-065438.twr

3. This will open a selection file in the pico editor. Look through the file and clear the [x] for any line that should not be saved to the database. The process is essentially certifying that each filesystem change is valid and proper.

4. Save the file with ^O (Control-Oh)
5. Quit with ^X (Control-x)
6. Now you will be prompted for the local passphrase.

4. Changing the Policy

1. First follow the instructions to Update the Database

2. change to /etc/tripwire

3. edit the policy in twpol.txt

4. create the signed binary tw.pol file with tripwire --update-policy --secure-mode low twpol.txt

5. you will be prompted for the site and local passphrases

5. Updating the Configuration

1. change to /etc/tripwire

2. edit the configuration in twcfg.txt

3. run twadmin --create-cfgfile -S site.key -c tw.cfg twcfg.txt to create the signed binary tw.cfg file

4. you will be prompted for the site passphrase

6. Passphrases

MichaelLeonhard generated the passphrases. To obtain them, save your GPG public key to /root/$(USER).pubkey. Then send Michael an email about it. He will encrypt the passphrases with GPG and email them to you. The security of Tripwire depends on these passphrases. DO NOT store your private key or decrypt the passphrases on Fyodor. Here is the procedure:

1. Download the latest version of GPG to your personal computer
2. Check the signature of the downloaded file
3. Install GPG onto your personal computer

4. On your personal computer, create a public/private key pair with gpg --gen-key, use a good passphrase

5. Export an ASCII version of your public key with gpg --export -a >> public.key

6. Copy your public key to your home directory on Fyodor with scp public.key username@fyodor.hcoop.net:

7. SSH into Fyodor and demonstrate your administrative priveleges by copying the public key to a secure location, cp ~/public.key /root/username.pubkey (where username is your username)

8. Email MichaelLeonhard (username leonhard) to request a copy of the passphrases

9. Decrypt the passphrase:
   • Read Michael's email on your personal computer, copy the GPG message block to the clipboard

   • Open a terminal (or cmd prompt) on your personal computer and run gpg on your personal computer

   • Paste the GPG message block into the terminal
   • Type your secret passphrase, hit enter, then type CTRL-Z or ^Z
   • Write down the passphrases
   • Close the terminal

CategorySystemAdministration