Redhat8.0 : Tripwire

2003.04.06

	ZDNetエンタープライズHow-To セキュリティ Tripwireによるファイル改ざんの検知 手順など詳細に解説されています。
	Tripwire Japan 製品版 Tripwire の会社です
	E3Networks 製品版に関しての情報とセミナーなどを行っています。

コマンド	説明
# rpm -ivh tripwire-2.3.1-14.i386.rpm	rpmでパッケージをインストールします。
# /etc/tripwire/twinstall.sh	パスワードを設定します。
---------------------------------------------- The Tripwire site and local passphrases are used to sign a variety of files, such as the configuration, policy, and database files. Passphrases should be at least 8 characters in length and contain both letters and numbers. See the Tripwire manual for more information. ---------------------------------------------- Creating key files... (When selecting a passphrase, keep in mind that good passphrases typically have upper and lower case letters, digits and punctuation marks, and are at least 8 characters in length.) 　 Enter the site keyfile passphrase: Verify the site keyfile passphrase: Generating key (this may take several minutes)...Key generation complete. (When selecting a passphrase, keep in mind that good passphrases typically have upper and lower case letters, digits and punctuation marks, and are at least 8 characters in length.) サイトパスワード を設定します。 Enter the local keyfile passphrase: Verify the local keyfile passphrase: Generating key (this may take several minutes)...Key generation complete. ---------------------------------------------- Signing configuration file... ローカルパスワードを設定します。 　 Please enter your site passphrase: Wrote configuration file: /etc/tripwire/tw.cfg A clear-text version of the Tripwire configuration file /etc/tripwire/twcfg.txt has been preserved for your inspection. It is recommended that you delete this file manually after you have examined it. ---------------------------------------------- Signing policy file... 　 サイトパスワード を設定します。 Please enter your site passphrase: Wrote policy file: /etc/tripwire/tw.pol A clear-text version of the Tripwire policy file /etc/tripwire/twpol.txt has been preserved for your inspection. This implements a minimal policy, intended only to test essential Tripwire functionality. You should edit the policy file to describe your system, and then use twadmin to generate a new signed copy of the Tripwire policy. サイトパスワードを聞いているので，設定します
# /usr/sbin/tripwire --init Please enter your local passphrase: Parsing policy file: /etc/tripwire/tw.pol Generating the database... *** Processing Unix File System *** ### Warning: File system error. ### Filename: /proc/scsi ### そのようなファイルやディレクトリはありません ### Continuing... ### Warning: File system error. ### Filename: /usr/sbin/fixrmtab ### そのようなファイルやディレクトリはありません ### Continuing... (〜省略〜) ### Warning: File system error. ### Filename: /root/.gnome_private ### そのようなファイルやディレクトリはありません ### Continuing... Wrote database file: /var/lib/tripwire/{ホスト名}.twd The database was successfully generated.	最初のデータベースを作成します。 ローカルパスワードを聞いているので，設定します。 これで初期設定はできました。しかし，いくつかエラーが出ているはずです。 エラーの修正方法は，続く章を参照してください。

ポリシーファイルの修正

コマンド	説明
# /usr/sbin/tripwire -m c >> /tmp/rep.txt # grep Filename /tmp/rep.txt	レポートをいったん出力させて，エラーメッセージの箇所を grep コマンドで検索して，ファイル名を特定します。
# cp -p /etc/tripwire/twpol.txt /etc/tripwire/twpol.txt.org # vi /etc/tripwire/twpol.txt	元のtwpol.txtはバックアップを取り，修正しましょう。
/etc/tripwire/twpol.txt の修正箇所
65行目: HOSTNAME=localhost;            ↓ 65行目: HOSTNAME={自分のホスト名};	次のメッセージが出ていると思います。それは，ホスト名の設定がなされていないので，左記のように直しましょう。 98. File system error. Filename: /etc/tripwire/localhost-local.key そのようなファイルやディレクトリはありません
例: /sbin/accton -> $(SEC_CRIT) ;                ↓ 例: # /sbin/accton -> $(SEC_CRIT) ;	大抵は，監視対象外のファイルの行の先頭に，「#」を入れるだけでOK。です。
例: 751行目:  # /sbin/e2fsadm -> $(SEC_CRIT) ; tune2fs?                ↓ 例: 751行目:  /sbin/e2fsadm -> $(SEC_CRIT) ;	監視対象に入れたい場合は，頭の「#」を削除します。 Redhat8.0では，/sbin/e2fsadmは監視対象外になっています。監視対象に入れたい場合は，「#」を外しましょう。 この場合，「;」の後ろに余計な文字が入っているので，それも消します。

	デフォルトの/etc/tripwire/twpol.txt をベースにする
	存在するファイルは，全て監視する。(「#」があったら，外す)
	存在しないファイルは，全てコメントアウトする。(先頭に「#」を入れる)

tripwire_pol.pl

　

コマンド	説明
# cp -p /etc/tripwire/twpol.txt /etc/tripwire/twpol.txt.org # perl tripwire_pol.pl /etc/tripwire/twpol.txt > new_twpol.txt	元のtwpol.txtはバックアップを取り，修正しましょう。
# diff -w new_twpol.txt  /etc/tripwire/twpol.txt	比較して，問題ないか確認します。diffの-wオプションは，空白文字を無視します。 tripwire_pol.plは，出来る限り，空白文字を元のファイルを同じにするようにしましたが，一部そうなっていない部分があります。
# cat new_twpol.txt > /etc/tripwire/twpol.txt	twpol.txtを差し替えます。

コマンド	説明
# /usr/sbin/twadmin --create-polfile -S /etc/tripwire/site.key /etc/tripwire/twpol.txt Please enter your site passphrase: Wrote policy file: /etc/tripwire/tw.pol	ポリシーファイルに署名します。 サイトパスワードを設定します。 これによってポリシーファイルの改竄を避けられるようになります。
# /usr/sbin/tripwire --init Please enter your local passphrase: Parsing policy file: /etc/tripwire/tw.pol Generating the database... *** Processing Unix File System *** Wrote database file: /var/lib/tripwire/est.twd The database was successfully generated.	データベースを再構築します。 ローカルパスワードを設定します。

          
/etc/cron.daily/tripwire-check:

Parsing policy file: /etc/tripwire/tw.pol
*** Processing Unix File System ***
Performing integrity check...
Wrote report file: /var/lib/tripwire/report/katua-20030403-040711.twr


Tripwire(R) 2.3.0 Integrity Check Report

Report generated by:          root
Report created on:            Thu Apr  3 04:07:11 2003
Database last updated on:     Never

===============================================================================
Report Summary:
===============================================================================

Host name:                    example
Host IP address:              127.0.0.1
Host ID:                      None
Policy file used:             /etc/tripwire/tw.pol
Configuration file used:      /etc/tripwire/tw.cfg
Database file used:           /var/lib/tripwire/katua.twd
Command line used:            /usr/sbin/tripwire --check 

===============================================================================
Rule Summary: 
===============================================================================

-------------------------------------------------------------------------------
  Section: Unix File System
-------------------------------------------------------------------------------

  Rule Name                       Severity Level    Added    Removed  Modified 
  ---------                       --------------    -----    -------  -------- 
  Invariant Directories           66                0        0        0        
  Temporary directories           33                0        0        0        
  Tripwire Data Files             100               0        0        0        
  Critical devices                100               0        0        0        
  User binaries                   66                0        0        0        
  Tripwire Binaries               100               0        0        0        
  Libraries                       66                0        0        0        
  Operating System Utilities      100               0        0        0        
  File System and Disk Administraton Programs
                                  100               0        0        0        
  Kernel Administration Programs  100               0        0        0        
  Networking Programs             100               0        0        0        
  System Administration Programs  100               0        0        0        
  Hardware and Device Control Programs
                                  100               0        0        0        
  System Information Programs     100               0        0        0        
  Application Information Programs
                                  100               0        0        0        
  Shell Related Programs          100               0        0        0        
  Critical Utility Sym-Links      100               0        0        0        
  Shell Binaries                  100               0        0        0        
  Critical system boot files      100               0        0        0        
  Critical configuration files    100               0        0        0        
  System boot changes             100               0        0        0        
  OS executables and libraries    100               0        0        0        
  Security Control                100               0        0        0        
  Login Scripts                   100               0        0        0        
  Root config files               100               0        0        0        

Total objects scanned:  25204
Total violations found:  0

===============================================================================
Object Summary: 
===============================================================================

-------------------------------------------------------------------------------
# Section: Unix File System
-------------------------------------------------------------------------------

No violations.

===============================================================================
Error Report: 
===============================================================================

No Errors

-------------------------------------------------------------------------------
*** End of report ***

Tripwire 2.3 Portions copyright 2000 Tripwire, Inc. Tripwire is a registered
trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;
for details use --version. This is free software which may be redistributed
or modified only under certain conditions; see COPYING for details.
All rights reserved.
Integrity check complete.

　

レポートの例 (ファイルの変更があった場合：Modifiedで変更されたファイルが報告。)

/etc/cron.daily/00webalizer: [new_snode] Warning: String exceeds storage size (68) [new_snode] Warning: String exceeds storage size (68) /etc/cron.daily/tripwire-check: Parsing policy file: /etc/tripwire/tw.pol *** Processing Unix File System *** Performing integrity check... Wrote report file: /var/lib/tripwire/report/katua-20030401-040722.twr Tripwire(R) 2.3.0 Integrity Check Report Report generated by: root Report created on: Tue Apr 1 04:07:22 2003 Database last updated on: Never =============================================================================== Report Summary: =============================================================================== Host name: katua Host IP address: 172.17.28.50 Host ID: None Policy file used: /etc/tripwire/tw.pol Configuration file used: /etc/tripwire/tw.cfg Database file used: /var/lib/tripwire/katua.twd Command line used: /usr/sbin/tripwire --check =============================================================================== Rule Summary: =============================================================================== ------------------------------------------------------------------------------- Section: Unix File System ------------------------------------------------------------------------------- Rule Name Severity Level Added Removed Modified --------- -------------- ----- ------- -------- Invariant Directories 66 0 0 0 Temporary directories 33 0 0 0 Tripwire Data Files 100 0 0 0 Critical devices 100 0 0 0 * User binaries 66 0 0 5 Tripwire Binaries 100 0 0 0 * Libraries 66 0 0 12 Operating System Utilities 100 0 0 0 File System and Disk Administraton Programs 100 0 0 0 Kernel Administration Programs 100 0 0 0 Networking Programs 100 0 0 0 System Administration Programs 100 0 0 0 Hardware and Device Control Programs 100 0 0 0 System Information Programs 100 0 0 0 Application Information Programs 100 0 0 0 Shell Related Programs 100 0 0 0 Critical Utility Sym-Links 100 0 0 0 Shell Binaries 100 0 0 0 Critical system boot files 100 0 0 0 * Critical configuration files 100 0 0 4 * System boot changes 100 0 0 2 OS executables and libraries 100 0 0 0 Security Control 100 0 0 0 Login Scripts 100 0 0 0 * Root config files 100 0 0 2 Total objects scanned: 25204 Total violations found: 25 =============================================================================== Object Summary: =============================================================================== ------------------------------------------------------------------------------- # Section: Unix File System ------------------------------------------------------------------------------- ------------------------------------------------------------------------------- Rule Name: Libraries (/usr/lib) Severity Level: 66 ------------------------------------------------------------------------------- Modified: "/usr/lib/mrtg2" "/usr/lib/mrtg2/BER.pm" "/usr/lib/mrtg2/MRTG_lib.pm" "/usr/lib/mrtg2/Pod" "/usr/lib/mrtg2/Pod/InputObjects.pm" "/usr/lib/mrtg2/Pod/Parser.pm" "/usr/lib/mrtg2/Pod/PlainText.pm" "/usr/lib/mrtg2/Pod/Select.pm" "/usr/lib/mrtg2/Pod/Usage.pm" "/usr/lib/mrtg2/SNMP_Session.pm" "/usr/lib/mrtg2/SNMP_util.pm" "/usr/lib/mrtg2/locales_mrtg.pm" ------------------------------------------------------------------------------- Rule Name: User binaries (/usr/bin) Severity Level: 66 ------------------------------------------------------------------------------- Modified: "/usr/bin" "/usr/bin/cfgmaker" "/usr/bin/indexmaker" "/usr/bin/mrtg" "/usr/bin/rateup" ------------------------------------------------------------------------------- Rule Name: System boot changes (/var/log) Severity Level: 100 ------------------------------------------------------------------------------- Modified: "/var/log/wtmp" "/var/log/wtmp.1" ------------------------------------------------------------------------------- Rule Name: Critical configuration files (/etc/httpd/conf) Severity Level: 100 ------------------------------------------------------------------------------- Modified: "/etc/httpd/conf/ssl.crt" "/etc/httpd/conf/ssl.crt/server.crt" "/etc/httpd/conf/ssl.key" "/etc/httpd/conf/ssl.key/server.key" ------------------------------------------------------------------------------- Rule Name: Root config files (/root) Severity Level: 100 ------------------------------------------------------------------------------- Modified: "/root" "/root/.viminfo" =============================================================================== Error Report: =============================================================================== No Errors ------------------------------------------------------------------------------- *** End of report *** Tripwire 2.3 Portions copyright 2000 Tripwire, Inc. Tripwire is a registered trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY; for details use --version. This is free software which may be redistributed or modified only under certain conditions; see COPYING for details. All rights reserved. Integrity check complete.