HOWTO Setup Tripwire - Revision history

Gordp: /* File System Error Messages */

2018-01-04T22:51:46Z

File System Error Messages

← Older revision		Revision as of 22:51, 4 January 2018
Line 27:		Line 27:
	<font color=red>hostname</font> <font color=blue>~ #</font> '''emacs -nw /etc/tripwire/twpol.txt'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''emacs -nw /etc/tripwire/twpol.txt'''

	'''A BETTER WAY''' ~~Gentoo's Portage now includes mktwpol - use it like this (note that the invocation refers to a gentoo-oriented configuration, rather than the default mktwpol.cfg)~~:		'''A BETTER WAY''':
	<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/sbin/mktwpol.sh /etc/tripwire/mktwpol-~~gentoo-150205~~.rules > /etc/tripwire/twpol.txt'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/sbin/mktwpol.sh /etc/tripwire/mktwpol-default.rules > /etc/tripwire/twpol.txt'''
	~~Or, on older systems:~~
	~~<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/local/bin/mktwpol.sh -c /etc/tripwire/mktwpol-gentoo-150205.rules > /etc/tripwire/twpol.txt'''~~
	Check the resulting /etc/tripwire/twpol.txt file for sanity... for example, if the ruleset was incorrect or unspecified during invocation of mktwpol.sh, you may see a very-short twpol.txt file that only references the tripwire files :-(		Check the resulting /etc/tripwire/twpol.txt file for sanity... for example, if the ruleset was incorrect or unspecified during invocation of mktwpol.sh, you may see a very-short twpol.txt file that only references the tripwire files :-(

	~~'''ALTERNATIVELY''' you can use the mktwpol.sh script (above) to re-create the twpol.txt file:~~
	~~<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/local/bin/mktwpol.sh > /etc/tripwire/twpol.txt'''~~

	Then, update the policy file, delete and re-init the db:		Then, update the policy file, delete and re-init the db:

Gordp: /* Setting Up a Tripwire Installation */

2015-08-12T22:49:31Z

Setting Up a Tripwire Installation

← Older revision		Revision as of 22:49, 12 August 2015
Line 3:		Line 3:
	<font color=red>hostname</font> <font color=blue>~ #</font> '''emerge tripwire mktwpol'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''emerge tripwire mktwpol'''
	<font color=red>hostname</font> <font color=blue>~ #</font> '''cd /etc/tripwire'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''cd /etc/tripwire'''
	<font color=red>hostname</font> <font color=blue>~ #</font> '''emacs -nw /etc/tripwire/twpol.txt''' ''(change '''HOSTNAME=''' to the proper hostname)		<font color=red>hostname</font> <font color=blue>~ #</font> '''emacs -nw /etc/tripwire/twpol-GENERIC.txt''' ''(change '''HOSTNAME=''' to the proper hostname; no domain/no FQDN)
	<font color=red>hostname</font> <font color=blue>~ #</font> '''emacs -nw /etc/tripwire/twcfg.txt''' ''(change /bin/nano to /usr/bin/vi for use during updating, for example)''		<font color=red>hostname</font> <font color=blue>~ #</font> '''emacs -nw /etc/tripwire/twcfg.txt''' ''(change /bin/nano to /usr/bin/vi for use during updating, for example)''
	Create the keys, and sign the policy and configuration files:		Create the keys, and sign the policy and configuration files:

Gordp: /* File System Error Messages */

2015-03-27T22:58:49Z

File System Error Messages

← Older revision		Revision as of 22:58, 27 March 2015
Line 28:		Line 28:

	'''A BETTER WAY''' Gentoo's Portage now includes mktwpol - use it like this (note that the invocation refers to a gentoo-oriented configuration, rather than the default mktwpol.cfg):		'''A BETTER WAY''' Gentoo's Portage now includes mktwpol - use it like this (note that the invocation refers to a gentoo-oriented configuration, rather than the default mktwpol.cfg):
	<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/sbin/mktwpol.sh /etc/tripwire/mktwpol-gentoo-~~140404~~.rules > /etc/tripwire/twpol.txt'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/sbin/mktwpol.sh /etc/tripwire/mktwpol-gentoo-150205.rules > /etc/tripwire/twpol.txt'''
	Or, on older systems:		Or, on older systems:
	<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/local/bin/mktwpol.sh -c /etc/tripwire/mktwpol-gentoo-~~140404~~.rules > /etc/tripwire/twpol.txt'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/local/bin/mktwpol.sh -c /etc/tripwire/mktwpol-gentoo-150205.rules > /etc/tripwire/twpol.txt'''
	Check the resulting /etc/tripwire/twpol.txt file for sanity... for example, if the ruleset was incorrect or unspecified during invocation of mktwpol.sh, you may see a very-short twpol.txt file that only references the tripwire files :-(		Check the resulting /etc/tripwire/twpol.txt file for sanity... for example, if the ruleset was incorrect or unspecified during invocation of mktwpol.sh, you may see a very-short twpol.txt file that only references the tripwire files :-(

Gordp: /* File System Error Messages */

2015-01-16T18:27:39Z

File System Error Messages

← Older revision		Revision as of 18:27, 16 January 2015
Line 28:		Line 28:

	'''A BETTER WAY''' Gentoo's Portage now includes mktwpol - use it like this (note that the invocation refers to a gentoo-oriented configuration, rather than the default mktwpol.cfg):		'''A BETTER WAY''' Gentoo's Portage now includes mktwpol - use it like this (note that the invocation refers to a gentoo-oriented configuration, rather than the default mktwpol.cfg):
	<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/sbin/mktwpol.sh -c /etc/tripwire/mktwpol-gentoo-140404.rules > /etc/tripwire/twpol.txt'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/sbin/mktwpol.sh /etc/tripwire/mktwpol-gentoo-140404.rules > /etc/tripwire/twpol.txt'''
	Or, on older systems:		Or, on older systems:
	<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/local/bin/mktwpol.sh -c /etc/tripwire/mktwpol-gentoo-140404.rules > /etc/tripwire/twpol.txt'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/local/bin/mktwpol.sh -c /etc/tripwire/mktwpol-gentoo-140404.rules > /etc/tripwire/twpol.txt'''

Gordp: /* Setting Up a Tripwire Installation */

2015-01-16T18:23:42Z

Setting Up a Tripwire Installation

← Older revision		Revision as of 18:23, 16 January 2015
Line 1:		Line 1:
	=== Setting Up a Tripwire Installation ===		=== Setting Up a Tripwire Installation ===

	<font color=red>hostname</font> <font color=blue>~ #</font> '''emerge tripwire'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''emerge tripwire mktwpol'''
	<font color=red>hostname</font> <font color=blue>~ #</font> '''cd /etc/tripwire'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''cd /etc/tripwire'''
	<font color=red>hostname</font> <font color=blue>~ #</font> '''emacs -nw /etc/tripwire/twpol.txt''' ''(change '''HOSTNAME=''' to the proper hostname)		<font color=red>hostname</font> <font color=blue>~ #</font> '''emacs -nw /etc/tripwire/twpol.txt''' ''(change '''HOSTNAME=''' to the proper hostname)
	<font color=red>hostname</font> <font color=blue>~ #</font> '''emacs -nw /etc/tripwire/twcfg.txt''' ''(change /bin/nano to /usr/bin/vi for use during updating, for example)''		<font color=red>hostname</font> <font color=blue>~ #</font> '''emacs -nw /etc/tripwire/twcfg.txt''' ''(change /bin/nano to /usr/bin/vi for use during updating, for example)''
	Create the keys, and sign the policy and configuration files:		Create the keys, and sign the policy and configuration files:
	<font color=red>hostname</font> <font color=blue>~ #</font> '''cd /etc/tripwire ; ~~sh .~~/~~twinstall~~.sh''' ''(supply site- and local-key multiple times to setup, site-key another couple of times to sign tw.pol and tw.cfg)''
			<font color=red>hostname</font> <font color=blue>~ #</font> '''cd /etc/tripwire ; /bin/bash twsetup.sh''' ''(supply site- and local-key multiple times to setup, site-key another couple of times to sign tw.pol and tw.cfg)''
	Now initialize everything (creates the database file /var/lib/tripwire/$hostname.twd)		Now initialize everything (creates the database file /var/lib/tripwire/$hostname.twd)
	<font color=red>hostname</font> <font color=blue>~ #</font> '''tripwire --init'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''tripwire --init'''

Gordp: /* File System Error Messages */

2014-12-07T14:29:07Z

File System Error Messages

← Older revision		Revision as of 14:29, 7 December 2014
Line 27:		Line 27:

	'''A BETTER WAY''' Gentoo's Portage now includes mktwpol - use it like this (note that the invocation refers to a gentoo-oriented configuration, rather than the default mktwpol.cfg):		'''A BETTER WAY''' Gentoo's Portage now includes mktwpol - use it like this (note that the invocation refers to a gentoo-oriented configuration, rather than the default mktwpol.cfg):
			<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/sbin/mktwpol.sh -c /etc/tripwire/mktwpol-gentoo-140404.rules > /etc/tripwire/twpol.txt'''
			Or, on older systems:
	<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/local/bin/mktwpol.sh -c /etc/tripwire/mktwpol-gentoo-140404.rules > /etc/tripwire/twpol.txt'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/local/bin/mktwpol.sh -c /etc/tripwire/mktwpol-gentoo-140404.rules > /etc/tripwire/twpol.txt'''
	Check the resulting /etc/tripwire/twpol.txt file for sanity... for example, if the ruleset was incorrect or unspecified during invocation of mktwpol.sh, you may see a very-short twpol.txt file that only references the tripwire files :-(		Check the resulting /etc/tripwire/twpol.txt file for sanity... for example, if the ruleset was incorrect or unspecified during invocation of mktwpol.sh, you may see a very-short twpol.txt file that only references the tripwire files :-(

Gordp: /* File System Error Messages */

2014-06-24T16:16:15Z

File System Error Messages

← Older revision		Revision as of 16:16, 24 June 2014
Line 25:		Line 25:
	<br>		<br>
	<font color=red>hostname</font> <font color=blue>~ #</font> '''emacs -nw /etc/tripwire/twpol.txt'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''emacs -nw /etc/tripwire/twpol.txt'''
	'''ALTERNATIVELY''' you can use the mktwpol.sh script to re-create the twpol.txt file:
			'''A BETTER WAY''' Gentoo's Portage now includes mktwpol - use it like this (note that the invocation refers to a gentoo-oriented configuration, rather than the default mktwpol.cfg):
			<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/local/bin/mktwpol.sh -c /etc/tripwire/mktwpol-gentoo-140404.rules > /etc/tripwire/twpol.txt'''
			Check the resulting /etc/tripwire/twpol.txt file for sanity... for example, if the ruleset was incorrect or unspecified during invocation of mktwpol.sh, you may see a very-short twpol.txt file that only references the tripwire files :-(

			'''ALTERNATIVELY''' you can use the mktwpol.sh script (above) to re-create the twpol.txt file:
	<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/local/bin/mktwpol.sh > /etc/tripwire/twpol.txt'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/local/bin/mktwpol.sh > /etc/tripwire/twpol.txt'''

Gordp: /* Setting Up a Tripwire Installation */

2012-06-19T17:38:28Z

Setting Up a Tripwire Installation

← Older revision		Revision as of 17:38, 19 June 2012
Line 11:		Line 11:
	Create the list of files we want to fingerprint and monitor:		Create the list of files we want to fingerprint and monitor:
	<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/local/bin/mktwpol.sh > /etc/tripwire/twpol.txt'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/local/bin/mktwpol.sh > /etc/tripwire/twpol.txt'''
	(If you don't have this on your system, grab it [[mktwpol.sh\|'''HERE''']], name it '''/usr/local/bin/mktwpol.sh''', and make it executable with '''chmod u+x /usr/local/bin/mktwpol.sh'''		(If you don't have this on your system, grab it [[MEDIA:mktwpol.sh\|'''HERE''']], name it '''/usr/local/bin/mktwpol.sh''', and make it executable with '''chmod u+x /usr/local/bin/mktwpol.sh'''

	=== Generate a Report ===		=== Generate a Report ===

Gordp: /* Setting Up a Tripwire Installation */

2012-06-18T19:12:13Z

Setting Up a Tripwire Installation

← Older revision		Revision as of 19:12, 18 June 2012
Line 5:		Line 5:
	<font color=red>hostname</font> <font color=blue>~ #</font> '''emacs -nw /etc/tripwire/twpol.txt''' ''(change '''HOSTNAME=''' to the proper hostname)		<font color=red>hostname</font> <font color=blue>~ #</font> '''emacs -nw /etc/tripwire/twpol.txt''' ''(change '''HOSTNAME=''' to the proper hostname)
	<font color=red>hostname</font> <font color=blue>~ #</font> '''emacs -nw /etc/tripwire/twcfg.txt''' ''(change /bin/nano to /usr/bin/vi for use during updating, for example)''		<font color=red>hostname</font> <font color=blue>~ #</font> '''emacs -nw /etc/tripwire/twcfg.txt''' ''(change /bin/nano to /usr/bin/vi for use during updating, for example)''
			Create the keys, and sign the policy and configuration files:
			<font color=red>hostname</font> <font color=blue>~ #</font> '''cd /etc/tripwire ; sh ./twinstall.sh''' ''(supply site- and local-key multiple times to setup, site-key another couple of times to sign tw.pol and tw.cfg)''
			Now initialize everything (creates the database file /var/lib/tripwire/$hostname.twd)
			<font color=red>hostname</font> <font color=blue>~ #</font> '''tripwire --init'''
	Create the list of files we want to fingerprint and monitor:		Create the list of files we want to fingerprint and monitor:
	<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/local/bin/mktwpol.sh > /etc/tripwire/twpol.txt'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/local/bin/mktwpol.sh > /etc/tripwire/twpol.txt'''
	(If you don't have this on your system, grab it [[mktwpol.sh\|'''HERE''']], name it '''/usr/local/bin/mktwpol.sh''', and make it executable with '''chmod u+x /usr/local/bin/mktwpol.sh'''		(If you don't have this on your system, grab it [[mktwpol.sh\|'''HERE''']], name it '''/usr/local/bin/mktwpol.sh''', and make it executable with '''chmod u+x /usr/local/bin/mktwpol.sh'''
	~~Create the keys, and sign the policy and configuration files:~~
	<font color=red>hostname</font> <font color=blue>~ #</font> '''sh ./twinstall.sh''' ''(supply site- and local-key multiple times to setup, site-key another couple of times to sign tw.pol and tw.cfg)''
	~~Now initialize everything (creates the database file /var/lib/tripwire/$hostname.twd)~~
	~~<font color=red>hostname</font> <font color=blue>~ #</font> '''tripwire --init'''~~

	=== Generate a Report ===		=== Generate a Report ===

Gordp: /* File System Error Messages */

2011-07-06T15:35:03Z

File System Error Messages

← Older revision		Revision as of 15:35, 6 July 2011
Line 25:		Line 25:
	<br>		<br>
	<font color=red>hostname</font> <font color=blue>~ #</font> '''emacs -nw /etc/tripwire/twpol.txt'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''emacs -nw /etc/tripwire/twpol.txt'''
			'''ALTERNATIVELY''' you can use the mktwpol.sh script to re-create the twpol.txt file:
			<font color=red>hostname</font> <font color=blue>~ #</font> '''/usr/local/bin/mktwpol.sh > /etc/tripwire/twpol.txt'''

	Then, update the policy file, delete and re-init the db:		Then, update the policy file, delete and re-init the db: