tripwire (Intrusion Detection Program)

To install tripwire, you need to:

Tripwire is an monitoring app with its own database for a machine. Hence, one needs to configure it according to the local specifications. As starter, you must get into root account to proceed. Then, proceed to change current directory to:

Since tripwire is a security application, you need to generate 2 unique keys: a site key and a local key. To generate the keys, you execute the following:

tripwire does not prepare a default configurations in /usr directory. Therefore, twcfg.txt and twpol.txt are the only copy. Therefore, you must make a backup version for the default ones manually.

With a backup copy done, the next thing to do is to edit the twcfg.txt and twpol.txt.

In twcfg.txt, you need to ensure the notable stuff likes:

1. every pointed locations are valid and exists.
2. ensure SITEKEYFILE is pointing to the correct keyfile. Example based on the above, "SITEKEYFILE =/etc/tripwire/site.key".
3. ensure LOCALKEYFILE is pointing to the correct keyfile. Example based on the above, "LOCALKEYFILE =/etc/tripwire/local.key".

In twpol.txt, you need to configure what needs to be monitored. Otherwise, you may leave it as it is to monitor critical filesystem. Some notable stuff are:

• Key must match your key filepath:

# Tripwire Data Files - ...

...

        $(TWETC)/site.key

        $(TWETC)/local.key

• Remove /etc/rc.boot if not used (most deployments no longer use rc.boot):

# Critical System Boot Files

...

/etc/rc.boot

• Remove specific files inside /root directory (not the /root first line) like:

# These files change the behavior of the root account

/root/mail

/root/Mail

/root/.xsession-errors

/root/.xauth

/root/.tcshrc

/root/.sawfish

/root/.pinerc

/root/.mc

/root/.gnome_private

...

NOTE: only keep those you need. Otherwise, this is overly paranoid and noisy because not every OS configurations are the same (e.g. rarely people will use sawfish now a days).

The next thing to do is to encrypt both configuration and pooling files. You can do the following:

When completed with no error, you can initialize tripwire:

Now that everything is completed and initialized successfully, you can remove the plaintext version of the configuration and pooling files. You can do that by:

You can recover them back by doing the following (but only when you're debugging or doing cryptanalysis):

To execute a local check, you can execute the following: