Installing and running Tripwire
By: Aleksandar Stancin (sal@net-security.org)
The following article deals with a little software package known as Tripwire, available for Linux as well as for other Unix variants and Windows. Only the Linux version is open source though, others are commercial.
What is Tripwire?
Tripwire is easily described as a file integrity tool, meaning it is designed to maintain a database of software packages installed on your system, allowing you to quickly examine and trace changes on your system. Tripwire can prove to be very effective measure against malicious code, sniffers, trojans or any other software post installed to your system. Please notice that Tripwire, effective as it is, cannot help you if your system has been compromised prior to the installation of Tripwire. So, in order to use it properly, I advise you to install it just after you install and set up your system. But, to go one step at the time...
Acquiring and installing Tripwire
Tripwire can be obtained here, wether you like rpms or source code, the choice is yours. Download and install it. If you choose to download the source code and compile it yourself, you should easily install it, by following the instructions available with it. For the sake of this article, I have chosen the rpm version to quickly install it, and get to the point. :) So, go to the folder in wich you have downloaded it and:
tar xvzf tripwire-2.3-47.i386.tar.gz
This will install Tripwire on your system. The following step is to
customize it to your needs, adjusting the policy file located in,
/etc/tripwire/, called twpol.txt. This file is created after the installation, as a minimalistic version of it, and is ment for you to customize. Lets have a look at it. It may seem somewhat complex and confusing, but it is actually quite simple. It requies some knowledge, though, about the system you installed it to. So, look into it, and alter it to your needs, or your system's setup. When you finish with it, you must run 'twadmin' to generate a signed policy file. So:
cd /etc/tripwire
twadmin
In order to finish the installation of Tripwire, you have to execute a
script called 'twinstall.sh', also located in /etc/tripwire. So, continue
by typing (while still in /etc/tripwire):
./twinstall.sh
Upon starting the script you will be asked to enter your passphrase, of minimum 8 characters in length. Combine upper and lower cases, as well as numbers, or even whitespaces. Select one, and remeber it. When proceeding further with the installation, you will be prompted for more passphrases, select them carefully and remember them (write them down on a piece of paper, in your palm, or anywhere you can reach it, but keep them for yourself).
That's it! If all went well, you should have Tripwire installed, and ready to run.
Ready to do some serious fencing...
Initialize the Tripwire database by issuing the following command:
tripwire --init
This will create a snapshot of your system. If you see errors occuring during creation of the database, it is most likely due to the policy file, customizing it to suit your system will solve these errors. If that is the case, you'll have to go to the first step and edit the /etc/tripwire/twpol.txt file, and re-run twadmin. When creating a database, it may take some time, depending on your system, so be patient and wait a bit. If it all went well, you should have your Tripwire database ready. If you want to make a check of the components installed on your system, all you have to do is type:
tripwire --check
And it will, after some time, depending on the system, generate a report, that should look something like this.
As you can clearly see, this will allow you to take notice of any software added or removed to/from your system. If you notice the little error section at the end of the report, it means you have to adjust the policy file to the setup of your system, or it will continue to display them. Of course, the above stated report is an example, any yours may vary. As more and more software is installed, you'll see various changes in the report.
Naturally, Tripwire has more options than those stated above, you can find out more about them here, or some quick ones by typing 'tripwire --help'.
It is quite obvious that Tripwire is a very useful piece of software, and can help you quite a bit in your daily system maintnance. You can use Tripwire to guard your system from sniffers, trojans or any other malicious code, because it provides you with a way to keep trace of software installed, removed or modified on your system. For proper use, Tripwire has to be installed immediatley after the entire system is installed and set up, in order to create a clean snapshot of the system. In conjunction with other security measures, Tripwire can be prove to be a great asset.
