Tripwire - File Integrity Checking

Tripwire is a file integrity checker used to monitor whether specified files have changed; these changes include (but are not limited to):

inode
timestamp
file size
file permissions and ownership attributes
hash value
file type

During initialization, Tripwire scans the filesystem and stores each file’s checksum in a database, establishing a baseline of normal files. On the next scan, it compares each file’s checksum against the one in the database; if the checksums differ, it reports any anomaly via an email alert or the log.

Installation

apt-get install tripwire

During installation you need to set passwords: the Site passphrase is used to encrypt tw.cfg and tw.pol, and the Local passphrase is used to encrypt the database and report files

Configuration

tw.cfg is Tripwire’s encrypted configuration file; twcfg.txt is that file’s unencrypted form
tw.pol is Tripwire’s encrypted policy file; twpol.txt is that file’s unencrypted form
local.key is the local key, used to protect the database
site.key is the site key, used to protect tw.cfg and tw.pol

Usage

Adjusting the policy file tw.pol

vi  twpol.txt
twadmin --create-polfile --polfile tw.pol -S site.key twpol.txt

Show the policy file

twadmin --print-polfile

Adjusting the configuration file tw.cfg

``vi twcfg.txt``
``twadmin --create-cfgfile --cfgfile tw.cfg -S site.key twcfg.txt``

Show the configuration file

twadmin --print-cfgfile

Initializing the database

tripwire --init

Once initialization finishes, a database is generated under /var/lib/tripwire/

Running a check

tripwire --check

Once the check finishes, a detection report is generated under /var/lib/tripwire/report/

Reading the detection results

twprint --print-report -r /var/lib/tripwire/report/*.twr

Updating the database

If a file’s change is legitimate, the database should be updated to ignore that change

tripwire --update -r /var/lib/tripwire/report/*.twr

After running this command, you’re taken into an editor. Search for the reported file names. All violations or updates have an [x] in front of the file name.

If you want to accept these changes as legitimate, simply save and quit the file. Tripwire will no longer report on this file. If you don’t want this file added to the database, delete the ‘x’.

When you save the file and exit the editor, if a database update is pending you’ll be prompted for a password to complete the process. If no update is pending, Tripwire will notify you, and no password is required.

Updating the policy file tw.pol

Subsequent updates to the policy file should take the following form

tripwire --update-policy --secure-mode low twpol.txt