A tutorial to install and configure Tripwire, an intrusion detection and file integrity monitoring (FIM) tool.
This advanced tutorial is reserved for premium members.
tripwire --init photographs the state of the system and declares it as the reference. If the machine has already been compromised, the modified binary or the file dropped by the attacker enters the baseline as a normal item and will never be reported. A baseline created on a questionable system gives false assurance, which is worse than having no integrity monitoring at all.tripwire --init. The local key protects that machine's database and reports, and it is the one asked for when you read the result of a tripwire --check. These passphrases cannot be recovered: without them you can neither read a report nor update the baseline, so store them in a vault exactly like a root password.sudo tripwire --update --twrfile /var/lib/tripwire/report/YOUR_REPORT.twr so they are folded into the baseline. Skip that step and the same lines come back in every report until you stop reading them, which defeats the whole point of the tool..twr report file from /var/lib/tripwire/report/ in an editor before running the update: each modification is preceded by a box ticked with an x. Remove the x from the lines you do not want to accept, save, then run tripwire --update --twrfile. Unticked entries stay out of the baseline and keep being reported, which is exactly the behaviour you want for a suspicious change./etc/cron.daily/tripwire-check script that runs /usr/sbin/tripwire --check and pipes the output to mail, then make it executable with sudo chmod +x /etc/cron.daily/tripwire-check: without that chmod, cron silently ignores the file. Plan on tuning twpol.txt in parallel to exclude files that change constantly, such as logs and caches, or the daily report will quickly become unreadable.Did you enjoy this article?
Comments