Tripwire is a free and open-source Linux Intrusion Detection System. It is used to detect and report any unauthorized change in files and directories on Linux. It will also send you an alert on email on file/directory changes. Tripwire works by comparing the current filesystem state against a known baseline state and reports if detect any changes.
In this post, we will show you how to install and configure Tripwire on Debian 10.
Prerequisites
- A server running Debian 10.
- A root password is configured on the server.
Getting Started
First, update the system packages to the updated version by running the following command:
apt-get update -yOnce all the packages are updated, you can proceed to the next step.
Install Tripwire
By default, the Tripwire package is available in the Debian 10 default repository. You can install it using the following command:
apt-get install tripwire -yDuring the installation, you will be asked to select the email configuration as shown below:
Select your desired option and hit ENTER. You will be asked to set up a system mail name as shown below:
Provide your system mail name and hit ENTER. You will be asked to create your site key passphrase as shown below:
Select Yes and hit ENTER. You will be asked to rebuild the Tripwire configuration file as shown below:
Select Yes and hit ENTER. You will be asked to rebuild your Tripwire policy file as shown below:
Select Yes and hit ENTER. You will be asked to provide your site-key passphrase as shown below:
Provide your password and hit ENTER. You will be asked to set your local key passphrase as shown below:
Provide your password and hit ENTER. Once Tripwire has been installed, you should see the following screen:
Click on the Ok button to finish the installation.
Configure Tripwire
Next, you will need to generate Tripwire keys and initialize the database. First, change the directory to Tripwire and list all keys and files with the following command:
cd /etc/tripwire/
lsYou should see the following output:
debian10-local.key site.key tw.cfg twcfg.txt tw.pol twpol.txt
Next, edit the Tripwire configuration file and set REPORTLEVEL to 4
nano /etc/tripwire/twcfg.txtChange the following line:
REPORTLEVEL =4
Save and close the file when you are finished.
Next, generate a new configuration file with the following command:
twadmin -m F -c tw.cfg -S site.key twcfg.txtYou will be asked to provide your site passphrase as shown below:
Please enter your site passphrase: Wrote configuration file: /etc/tripwire/tw.cfg
Next, create a twpolmake.pl file to optimize Tripwire policy.
nano twpolmake.plAdd the following lines:
#!/usr/bin/perl
$POLFILE=$ARGV[0];
open(POL,"$POLFILE") or die "open error: $POLFILE" ;
my($myhost,$thost) ;
my($sharp,$tpath,$cond) ;
my($INRULE) = 0 ;
while () {
chomp;
if (($thost) = /^HOSTNAMEs*=s*(.*)s*;/) {
$myhost = `hostname` ; chomp($myhost) ;
if ($thost ne $myhost) {
$_="HOSTNAME="$myhost";" ;
}
}
elsif ( /^{/ ) {
$INRULE=1 ;
}
elsif ( /^}/ ) {
$INRULE=0 ;
}
elsif ($INRULE == 1 and ($sharp,$tpath,$cond) = /^(s*#?s*)(/S )b(s ->s . )$/) {
$ret = ($sharp =~ s/#//g) ;
if ($tpath eq '/sbin/e2fsadm' ) {
$cond =~ s/;s (tune2fs.*)$/; #$1/ ;
}
if (! -s $tpath) {
$_ = "$sharp#$tpath$cond" if ($ret == 0) ;
}
else {
$_ = "$sharp$tpath$cond" ;
}
}
print "$_n" ;
}
close(POL) ;
Save and close the file then create a configuration file with the following command:
perl twpolmake.pl twpol.txt > twpol.txt.new
twadmin -m P -c tw.cfg -p tw.pol -S site.key twpol.txt.newYou should see the following output:
Please enter your site passphrase: Wrote policy file: /etc/tripwire/tw.pol
Next, create a Tripwire database with the following command:
tripwire -m i -s -c tw.cfgYou should see the following output:
Please enter your local passphrase: ### Warning: File system error. ### Filename: /var/lib/tripwire/debian10.twd ### No such file or directory ### Continuing...
You can also display the generated database with the following command:
twprint -m d -d /var/lib/tripwire/debian10.twdYou should see the following output:
Open Source Tripwire(R) 2.4.3.7 Database Database generated by: root Database generated on: Sun 09 May 2021 08:39:18 AM UTC Database last updated on: Never =============================================================================== Database Summary: =============================================================================== Host name: debian10 Host IP address: 45.58.38.142 Host ID: None Policy file used: /etc/tripwire/tw.pol Configuration file used: /etc/tripwire/tw.cfg Database file used: /var/lib/tripwire/debian10.twd Command line used: tripwire -m i -s -c tw.cfg =============================================================================== Object Summary: =============================================================================== ------------------------------------------------------------------------------- # Section: Unix File System -------------------------------------------------------------------------------
If you want to update the Tripwire database, run the following command:
tripwire --update --accept-allYou should get the following output:
### Error: File could not be opened. ### Filename: /var/lib/tripwire/report/debian10-20210509-084141.twr ### No such file or directory ### Exiting...
Now, test the Tripwire using the following command:
tripwire -m c -s -c /etc/tripwire/tw.cfgYou should see the following output:
Open Source Tripwire(R) 2.4.3.7 Integrity Check Report Report generated by: root Report created on: Sun 09 May 2021 08:42:15 AM UTC Database last updated on: Never =============================================================================== Report Summary: =============================================================================== Host name: debian10 Host IP address: 45.58.38.142 Host ID: None Policy file used: /etc/tripwire/tw.pol Configuration file used: /etc/tripwire/tw.cfg Database file used: /var/lib/tripwire/debian10.twd Command line used: tripwire -m c -s -c /etc/tripwire/tw.cfg =============================================================================== Rule Summary: =============================================================================== ------------------------------------------------------------------------------- Section: Unix File System ------------------------------------------------------------------------------- Rule Name Severity Level Added Removed Modified --------- -------------- ----- ------- -------- Other binaries 66 0 0 0 Tripwire Binaries 100 0 0 0 Other libraries 66 0 0 0 Root file-system executables 100 0 0 0 * Tripwire Data Files 100 1 0 0 System boot changes 100 0 0 0 Root file-system libraries 100 0 0 0 (/lib) Critical system boot files 100 0 0 0 * Other configuration files 66 0 0 1 (/etc) Boot Scripts 100 0 0 0 Security Control 66 0 0 0 Root config files 100 0 0 0 Devices & Kernel information 100 0 0 0 (/dev) Invariant Directories 66 0 0 0 Total objects scanned: 27975 Total violations found: 2 =============================================================================== Object Summary: =============================================================================== ------------------------------------------------------------------------------- # Section: Unix File System ------------------------------------------------------------------------------- ------------------------------------------------------------------------------- Rule Name: Tripwire Data Files (/var/lib/tripwire/debian10.twd) Severity Level: 100 -------------------------------------------------------------------------------
By default, Tripwire report files are located at /var/lib/tripwire/report/:
ls /var/lib/tripwire/report/Output:
debian10-20210509-084215.twr
You can check this report using the following command:
twprint -m r -t 4 -r /var/lib/tripwire/report/debian10-20210509-084215.twrVerify Tripwire IDS
At this point, Tripwire is installed and configured. Now, it’s time to check whether Tripwire is working or not.
First, create some files in your system with the following command:
touch fil1 file2 file3 file4 file5Now, run the Tripwire to check whether the Tripwire detects these files or not:
tripwire --check --interactiveYou should see the newly created files in the following output:
Open Source Tripwire(R) 2.4.3.7 Integrity Check Report Report generated by: root Report created on: Sun 09 May 2021 08:46:36 AM UTC Database last updated on: Never =============================================================================== Report Summary: =============================================================================== Host name: debian10 Host IP address: 45.58.38.142 Host ID: None Policy file used: /etc/tripwire/tw.pol Configuration file used: /etc/tripwire/tw.cfg Database file used: /var/lib/tripwire/debian10.twd Command line used: tripwire --check --interactive =============================================================================== ------------------------------------------------------------------------------- Rule Name: Other configuration files (/etc) Severity Level: 66 ------------------------------------------------------------------------------- Remove the "x" from the adjacent box to prevent updating the database with the new values for this object. Modified: [x] "https://www.howtoforge.com/etc/tripwire" ------------------------------------------------------------------------------- Rule Name: Root config files (/root) Severity Level: 100 ------------------------------------------------------------------------------- Remove the "x" from the adjacent box to prevent updating the database with the new values for this object. Added: [x] "https://www.howtoforge.com/root/file4" [x] "https://www.howtoforge.com/root/file3" [x] "https://www.howtoforge.com/root/fil1" [x] "https://www.howtoforge.com/root/file2" [x] "https://www.howtoforge.com/root/file5" Modified: [x] "https://www.howtoforge.com/root" ===============================================================================
You can also check the generated report later using the following command:
twprint --print-report --twrfile /var/lib/tripwire/report/debian10-20210509-084636.twrAutomate Tripwire Report
You can also set up a cron job to run a Tripwire at a specific time. You can do it with the following command:
crontab -eAdd the following lines:
00 06 * * * /usr/sbin/tripwire --check
Save and close the file when you are finished.
The above file will run a Tripwire every morning at 06:00 AM. You can check the generated report at /var/lib/tripwire/report/.
Conclusion
Congratulations! you have successfully installed and configured Tripwire IDS on Debian 10. I hope this will help you to check which files or directories are modified on your system.
