Tripwire 配置实例

weixiao

============Tripwire 配置实例==============

..每次登录系统root帐户都收到信件，内容如下，很不爽，决定探索一下。


=1。打开信件：

------------------------------------------
Message 40:
From root  Tue Mar 22 14:00:12 2005
Date: Tue, 22 Mar 2005 14:00:12 +0800
From: root@localhost.localdomain (Anacron)
To: root@localhost.localdomain
Subject: Anacron job 'cron.daily'

/etc/cron.daily/tripwire-check:

****    Error: Tripwire database for localhost.localdomain not found.    ****
**** Run /etc/tripwire/twinstall.sh and/or tripwire --init. ****
------------------------------------------

#rpm -q tripwire
tripwire-2.3.1-10

#rpm -ql tripwire|head
/etc/cron.daily/tripwire-check
/etc/tripwire
/etc/tripwire/twcfg.txt
/etc/tripwire/twinstall.sh
/etc/tripwire/twpol.txt
/usr/sbin/siggen
/usr/sbin/tripwire
/usr/sbin/twadmin
/usr/sbin/twprint
............................

#more /etc/cron.daily/tripwire-check
----------------------------------------------------
#!/bin/sh
HOST_NAME=`uname -n`
if [ ! -e /var/lib/tripwire/${HOST_NAME}.twd ] ; then
        echo "****    Error: Tripwire database for ${HOST_NAME} not found.    ****"
        echo "**** Run "/etc/tripwire/twinstall.sh" and/or "tripwire --init". ****"
else
        test -f /etc/tripwire/tw.cfg &&  /usr/sbin/tripwire --check
fi
-----------------------------------------------------
..tripwire-check shell内容是检查tripwire是否初始化，用/etc/tripwire/tw.cfg加密文件作判断。

#ls -F /etc/tripwire/
twcfg.txt  twinstall.sh*  twpol.txt

..twcfg.txt 是配置文件，包含配置时变量。如：SITEKEYFILE为远程密钥，LOCALKEYFILE用来加密数据库的本地密钥。LOOSEDIRECTORYCHECKING设置为ture时会去掉一些相同报告。SYSLOGREPORTING默认不作日志记录。


=2。设置密钥：

#/etc/tripwire/twinstall.sh
..................
Creating key files..
..................
Enter the site keyfile passphrase:**********
Verify the site keyfile passphrase:**********
Generating key (this may take several minutes)
....................
Enter the local keyfile passphrase:**********
Verify the local keyfile passphrase:**********
Generating key (this may take several minutes)..
..................
Please enter your site passphrase:**********
..................

#ls /etc/tripwire
localhost.localdomain-local.key  tw.cfg     twinstall.sh  twpol.txt
site.key                         twcfg.txt  tw.pol


=3。若想修改twcfg.txt配置，如下：

#vi /etc/tripwire/twcfg.txt

#/usr/sbin/twadmin -m F -S /etc/tripwire/site.key /etc/tripwire/twcfg.txt

Please enter your site passphrase: **********
Wrote configuration file: /etc/tripwire/tw.cfg


=4。显示配置变量：

#/usr/sbin/twadmin -m f

..可以把twcfg.txt，twpol.txt删除，twadmin命令可再恢复(详细请看帮助文档)

#rm /etc/tripwire/twcfg.txt
#/usr/sbin/twadmin -m f > /etc/tripwire/twcfg.txt


=5。/etc/tripwire/tw.pol为策略文件，策略配置文件twpol.txt包含一些需要取指纹的文件和目录。

..举例说明变量属性：
#more /etc/tripwire/twpol.txt
#grep home /etc/tripwire/twpol.txt
  /home    -> $(SEC_INVARIANT) (recurse = 0) ;

#grep 'SEC_INVARIANT =' /etc/tripwire/twpol.txt
SEC_INVARIANT = +tpug ;

+tpug 属性是指对/home目录的文件类型，权限，用户ID，组ID取指纹。


=6。建立数据库，tripwire初始化：（3，4，5步骤可省略）

#/usr/sbin/tripwire --init
.........................
.........................
Wrote database file: /var/lib/tripwire/localhost.localdomain.twd
The database was successfully generated.


=7。RH系统对tripwire比较模式自动化怎样设置？

#more /etc/crontab
..............
02 4 * * * root run-parts /etc/cron.daily
.............

[注：每天4点02分以root身份执行/etc/cron.daily目录下所有文件]

这篇实例文档是遇到问题进行摸索，要对tripwire认识透彻，参考资料文档。


=8。修改策略配置文件twpol.txt，适合自己系统：

..策略文件是把文件，目录或设备配建‘指纹’，使tripwire执行比较模式时有规可随。那当策略文件中所标识文件，目录或设备，系统还没存在，就是更新数据库后也反映错误信息，解决办法是在策略文件中把不存在的注释掉。

#tripwire -m c &> /tmp/tripwire.test
#more /tmp/tripwire.test
.....................
.....................
154. File system error.
     Filename: /root/.xsession-errors
     No such file or directory
.....................
.....................

..[/root/.xsession-errors是要在策略文件准备注释掉的object_name]


#awk '/[^#][[:space:]]Filename:/{print $2}' /tmp/tripwire.test >/tmp/wei.test

#wc -l /tmp/wei.test
154 /tmp/wei.test

..[有154个object_name要注释]

#for file in $(cat /tmp/wei.test);do grep $file /root/twpol.txt &> /dev/null || echo "$file can't in twpol.txt" ;done

/etc/tripwire/localhost-local.key can't in twpol.txt

..[154个object_name中localhost-local.key文件需要关注]

#vi /etc/tripwire/twpol.txt

..[注：把154个object_name注释掉。注意localhost-local.key是对应$(TWLKEY)/$(HOSTNAME)-local.key，:-D]

#twadmin -m p /etc/tripwire/twpol.txt

..[对修改过的策略文件进行语法检测，检测成功会提示输入密钥。注：检测总不成功，只好从头来干。]

#rm /etc/tripwire/*.key
#rm /etc/tripwire/{tw.cfg,tw.pol}
#/etc/tripwire/twinstall.sh
#tripwire --init

#tripwire -m c

..[应该错误信息少了很多，如果不想每次都检测出相同报告，要更新数据库。先在/var/lib/tripwire/report/目录找最新报告文件，如：localhost.localdomain-20050330-155508.twr]

#tripwire -m u -r /var/lib/tripwire/report/localhost.localdomain-20050401-155508.twr

..[进入编辑器，(X)代表要更新文件，( )文件不作更新。选择后 :wq 保存退出。]


=9。若觉得自动检测麻烦，可改手动：

..把/etc/cron.daily目录下tripwire-check文件mv。有时间就tripwire -m c 进行手动检测。

..[注：实例中还有没解决的，请各位指点！]