Fedora Users — Re: Monitoring file integrity with FC4

I'd never heard of Tripwire before, but it sounds like the ultimate virus defence to me. Can it stop programs from running if they have been changed without Tripwire being told? Or do you just get told when a file has been modified (via the cron job, by which time it's probably too late)?
The second thought that occurred to me was that, if a virus was trying to modify system files, wouldn't it also attempt to update the Tripwire database to match, so Tripwire wouldn't flag the change? Could that be prevented? Does Tripwire monitor itself???
Ian

Scot L. Harris wrote:

On Thu, 2005-09-29 at 14:34, Hahnel William J (CI) wrote:

I'm looking for a mechanism to monitor the integrity of critical files
on my FC4 servers.  I understand Tripwire is the application to do it
but I am having no success getting it set up.  I downloaded the source
from SourceForge but can not follow how to set it up.  I could not
locate an RPM for the application.
 
Any help getting something set up would be greatly appreciated.
 
Thanks!
 
Bill Hahnel
CI National Operations Center


You should find a tripwire rpm in the extras repository for Fedora.

Note: the setup script is now located in
/usr/sbin/tripwire-setup-keyfiles.  It explains this in one of the
readme files that comes with the rpm.  That file will setup the key
files for your system.  You will need to edit the policy file to get
things configured the way you want and to eliminate items which are not
installed on your system or which you don't want to monitor.  Then run
through the normal steps for setting up the database and running the
report.  

One alternative to tripwire is AIDE.  The last time I looked at it
though it seemed to be immature and not quite ready.  It did not sign
the policy or database files which means to setup this up in a secure
manner you would have to arrange to keep those files off line or on read
only media.  

I personally prefer tripwire.  I always found this RedHat documentation
to be useful when setting up or updating tripwire:

http://www.redhat.com/docs/manuals/linux/RHL-7.3-Manual/ref-guide/ch-tripwire.html

The only real change from those docs to now is the initialization script
which is /usr/sbin/tripwire-setup-keyfiles now.

I also came across this posting.  I have not tried this script but if it
does what it claims it could be very useful.  As always I would
recommend you manually check the policy file to make sure it is
monitoring the files you want on your system.

http://moongroup.com/pipermail/shell.scripting/2004-March/000849.html

If you use that script and it works let us know.

Re: Monitoring file integrity with FC4 - Tripwire??