Home

Tripwire: File Integrity Monitoring

Security
Difficulty: Advanced
4 min read

A tutorial to install and configure Tripwire, an intrusion detection and file integrity monitoring (FIM) tool.

Back to tutorials

Key takeaways

  • Tripwire builds a baseline: an encrypted database of cryptographic signatures (such as SHA-256) for the monitored files, stored in /var/lib/tripwire/ and created by sudo tripwire --init.
  • That baseline is only worth anything if it is taken on a known-clean system: installing Tripwire on an already compromised server amounts to certifying the backdoor as legitimate.
  • Two separate passphrases protect the tool: the site key, requested at initialisation, and the local key, requested to read the reports produced by tripwire --check. They are what prevents tampering with the database and the configuration.
  • The policy file /etc/tripwire/twpol.txt decides which files are watched and which attributes are compared (permissions, hash, size). It is the only real lever against report noise.
  • After a legitimate change you must accept the modifications with tripwire --update --twrfile /var/lib/tripwire/report/YOUR_REPORT.twr, otherwise they reappear in every subsequent report.
What is Tripwire?
Tripwire is a Host-based Intrusion Detection System (HIDS) and a File Integrity Monitoring (FIM) tool. Its operation is simple in theory: it creates a "baseline", a database containing the cryptographic signatures (such as SHA-256) of important files and directories. Then, at regular intervals, it compares the current state of the files against this baseline to detect any modification, deletion, or addition.

Why use Tripwire?

  • Compromise detection: If an attacker modifies a system binary (e.g. /bin/ls) to hide their tracks, Tripwire will detect it.
  • Compliance: Many security standards (PCI-DSS, HIPAA) require file integrity monitoring. Tripwire is a perfect tool for this.
  • Change control: Lets you ensure that only authorized changes are made to production servers.

Prerequisites

  • A Linux server (Ubuntu/Debian, CentOS/RHEL) in a known "clean" state. It is crucial to install Tripwire before the server is potentially compromised.
  • Root access or sudo privileges.

Premium Content

This advanced tutorial is reserved for premium members.

9,90€ / month
  • All advanced tutorials
  • New content every week
  • Progress tracking
  • Cancel anytime
Log in Create an account
MR

Written by

Morgann Riu

Cybersecurity and Linux administration expert. I share my knowledge through free tutorials and training to help system administrators and developers secure their infrastructures.

My profile LinkedIn GitHub

Frequently asked questions

Why does Tripwire have to be installed before the server goes into production?
Because tripwire --init photographs the state of the system and declares it as the reference. If the machine has already been compromised, the modified binary or the file dropped by the attacker enters the baseline as a normal item and will never be reported. A baseline created on a questionable system gives false assurance, which is worse than having no integrity monitoring at all.
What are the site key and the local key for, and what happens if I lose a passphrase?
The site key protects the policy and the configuration: its passphrase is requested during tripwire --init. The local key protects that machine's database and reports, and it is the one asked for when you read the result of a tripwire --check. These passphrases cannot be recovered: without them you can neither read a report nor update the baseline, so store them in a vault exactly like a root password.
Every <code>apt upgrade</code> produces a report full of modifications, is that normal?
Yes: a package update replaces binaries, so their fingerprints legitimately change. Once you have verified the report contains only those expected changes, accept them with sudo tripwire --update --twrfile /var/lib/tripwire/report/YOUR_REPORT.twr so they are folded into the baseline. Skip that step and the same lines come back in every report until you stop reading them, which defeats the whole point of the tool.
How do I reject only part of the changes during an <code>--update</code>?
Open the .twr report file from /var/lib/tripwire/report/ in an editor before running the update: each modification is preceded by a box ticked with an x. Remove the x from the lines you do not want to accept, save, then run tripwire --update --twrfile. Unticked entries stay out of the baseline and keep being reported, which is exactly the behaviour you want for a suspicious change.
How do I automate the checks and get the reports by email?
Create a /etc/cron.daily/tripwire-check script that runs /usr/sbin/tripwire --check and pipes the output to mail, then make it executable with sudo chmod +x /etc/cron.daily/tripwire-check: without that chmod, cron silently ignores the file. Plan on tuning twpol.txt in parallel to exclude files that change constantly, such as logs and caches, or the daily report will quickly become unreadable.

Share this tutorial

X LinkedIn WhatsApp

Did you enjoy this article?

Was this article helpful?

Thanks for your feedback!

Comments

Recommended for you

Sécurité

Auditd : Surveillance et Audit sur Linux

 DevOps

Logwatch : Surveillance et analyse de logs

 Sécurité

Lynis : Audit de sécurité pour Linux

 Sécurité

RKHunter : Détection de rootkits sur Linux

Checklist Sécurité Linux

30 points essentiels pour sécuriser un serveur Linux. Recevez aussi les nouveaux tutoriels par email.

Pas de spam. Désabonnement en 1 clic.

← Back to home
↑