Back to tutorials
What is Tripwire?
Tripwire is a Host-based Intrusion Detection System (HIDS) and a File Integrity Monitoring (FIM) tool. Its operation is simple in theory: it creates a "baseline", a database containing the cryptographic signatures (such as SHA-256) of important files and directories. Then, at regular intervals, it compares the current state of the files against this baseline to detect any modification, deletion, or addition.
Why use Tripwire?
- Compromise detection: If an attacker modifies a system binary (e.g.
/bin/ls) to hide their tracks, Tripwire will detect it.
- Compliance: Many security standards (PCI-DSS, HIPAA) require file integrity monitoring. Tripwire is a perfect tool for this.
- Change control: Lets you ensure that only authorized changes are made to production servers.
Prerequisites
- A Linux server (Ubuntu/Debian, CentOS/RHEL) in a known "clean" state. It is crucial to install Tripwire before the server is potentially compromised.
- Root access or sudo privileges.
Premium Content
This advanced tutorial is reserved for premium members.
9,90€ / month
- All advanced tutorials
- New content every week
- Progress tracking
- Cancel anytime
Comments