HOWTO Setup Tripwire
Setting Up a Tripwire Installation
hostname ~ # emerge tripwire hostname ~ # cd /etc/tripwire
Perform Customizations
Check that HOSTNAME= is sane (around line 64 - 70 depending on distribution
hostname ~ # emacs -nw /etc/tripwire/twpol.txt
Change the editor used by logwatch during updating:
hostname ~ # emacs -nw /etc/tripwire/twcfg.txt (change /bin/nano to /usr/bin/vi for example)
Create the keys, and sign the policy and configuration files:
hostname ~ # sh ./twinstall.sh (supply site- and local-key multiple times to setup, site-key another couple of times to sign tw.pol and tw.cfg)
Now initialize everything (creates the database file /var/lib/tripwire/$hostname.twd)
hostname ~ # tripwire --init
Generate a Report
hostname ~ # tripwire --check
The first time you do this, there will be a massive number of files not found. Go through these, one by one, and either find the proper location of the file, or comment them out in the twpol.txt. Many files seem to be re-located from what's in the original twpol.txt - like, a binary moved from /bin/ to /usr/bin/ or maybe from /sbin/ to /usr/sbin/. This first pass through is a huge pain in the butt, often with several hundred files needing review. You can jump-start this by copying over a similar config from another machine, but this runs the risk of incomplete coverage, and isn't recommended.
There are scripts out there (on the 'Net) which try to assist you in performing this first setup. Watch out: some merely comment-out the not-found files, without considering if the file has been re-located. This will result in incomplete coverage :-(
File System Error Messages
To get rid of "File system error." messages where the file or folder does not exist, first check to see if the file has been re-located (somewhat common when updating packages), or comment out the culprits from /etc/tripwire/twpol.txt if it's truly disappeared.
hostname ~ # emacs -nw /etc/tripwire/twpol.txt
Then, update the policy file, delete and re-init the db:
hostname ~ # twadmin --create-polfile -S /etc/tripwire/site.key /etc/tripwire/twpol.txt hostname ~ # rm /var/lib/tripwire/$hostname.twd hostname ~ # tripwire --init
Now, run a check, followed by an update. This shifts files around, which will be flagged as "changed" on the next run, so re-run the check/update:
hostname ~ # tripwire --check hostname ~ # tripwire --update --twrfile /var/lib/tripwire/report/<hostname_date_time>.twr hostname ~ # tripwire --check hostname ~ # tripwire --update --twrfile /var/lib/tripwire/report/<hostname_date_time>.twr
After System Changes
After you emerge packages or change config files:
hostname ~ # tripwire --update --twrfile /var/lib/tripwire/report/<a_previous_integrity_report>.twr
Tidying Up
After a while, the /var/log/tripwire/report/ directory becomes quite large. At some point, these historical reports are of no value, so they can be deleted. One guideline might be to blow away anything more than 6 months old.
Troubleshooting
An error of: Fatal Exception st9exception indicates that the tripwire database has become corrupted. Re-initialize (tripwire --init) and follow the steps under File System Error Messages.