Tripwire - Ernest G. Wilson II's FreeBSD Pages

Tripwire on FreeBSD 6.2

Prerequisites:

FreeBSD (Base + Autoconf, Automake, Bash and GCC)

Tripwire on FreeBSD

# Tripwire v2.4.0.1 http://sourceforge.net/projects/tripwire

# Install Tripwire
cd /usr/ports/security/tripwire
make install
# Answer questions and set various passwords (remember these passwords) when prompted.

# Setup email addresses for notification as described here:
# http://www.redhat.com/docs/manuals/linux/RHL-9-Manual/ref-guide/s1-tripwire-update-policy.html#S2-TRIPWIRE-EMAIL
mv /usr/local/etc/tripwire/twpol.txt /usr/local/etc/tripwire/twpol.txt.original
vi /usr/local/etc/tripwire/twpol.txt
# Be sure to replace every instance of YourEmail@YourDomain.com with your actual email address!
# Make sure you edit the "HOSTNAME=" variable! (Find out your hostname from a prompt by typing: hostname )

# # Global Variable Definitions # # These are defined at install time by the installation script. You may # Manually edit these if you are using this file directly and not from the # installation script itself. # @@section GLOBAL TWDOCS="/usr/local/share/doc/tripwire"; TWBIN="/usr/local/sbin"; TWPOL="/usr/local/etc/tripwire"; TWDB="/var/db/tripwire"; TWSKEY="/usr/local/etc/tripwire"; TWLKEY="/usr/local/etc/tripwire"; TWREPORT="/var/db/tripwire/report"; HOSTNAME=yourservername.yourdomain.com; @@section FS SEC_CRIT = $(IgnoreNone)-SHa ; # Critical files that cannot change SEC_SUID = $(IgnoreNone)-SHa ; # Binaries with the SUID or SGID flags set SEC_BIN = $(ReadOnly) ; # Binaries that should not change SEC_CONFIG = $(Dynamic) ; # Config files that are changed infrequently but accessed often SEC_TTY = $(Dynamic)-ugp ; # Tty files that change ownership at login SEC_LOG = $(Growing) ; # Files that grow, but that should never change ownership SEC_INVARIANT = +tpug ; # Directories that should never change permission or ownership SIG_LOW = 33 ; # Non-critical files that are of minimal security impact SIG_MED = 66 ; # Non-critical files that are of significant security impact SIG_HI = 100 ; # Critical files that are significant points of vulnerability # Tripwire Binaries ( rulename = "Tripwire Binaries", severity = $(SIG_HI), emailto = YourEmail@YourDomain.com ) { $(TWBIN)/siggen -> $(SEC_BIN) ; $(TWBIN)/tripwire -> $(SEC_BIN) ; $(TWBIN)/twadmin -> $(SEC_BIN) ; $(TWBIN)/twprint -> $(SEC_BIN) ; } # Tripwire Data Files - Configuration Files, Policy Files, Keys, Reports, Databases ( rulename = "Tripwire Data Files", severity = $(SIG_HI), emailto = YourEmail@YourDomain.com ) { # NOTE: We remove the inode attribute because when Tripwire creates a backup, # it does so by renaming the old file and creating a new one (which will # have a new inode number). Inode is left turned on for keys, which shouldn't # ever change. # NOTE: The first integrity check triggers this rule and each integrity check # afterward triggers this rule until a database update is run, since the # database file does not exist before that point. $(TWDB) -> $(SEC_CONFIG) -i ; $(TWPOL)/tw.pol -> $(SEC_BIN) -i ; $(TWPOL)/tw.cfg -> $(SEC_BIN) -i ; $(TWPOL)/twcfg.txt -> $(SEC_BIN) ; $(TWPOL)/twpol.txt -> $(SEC_BIN) ; $(TWLKEY)/$(HOSTNAME)-local.key -> $(SEC_BIN) ; $(TWSKEY)/site.key -> $(SEC_BIN) ; #don't scan the individual reports $(TWREPORT) -> $(SEC_CONFIG) (recurse=0) ; } # Tripwire HQ Connector Binaries #( # rulename = "Tripwire HQ Connector Binaries", # severity = $(SIG_HI) #) #{ # $(TWBIN)/hqagent -> $(SEC_BIN) ; #} # # Tripwire HQ Connector - Configuration Files, Keys, and Logs # # Note: File locations here are different than in a stock HQ Connector # installation. This is because Tripwire 2.3 uses a different path # structure than Tripwire 2.2.1. # # You may need to update your HQ Agent configuation file (or this policy # file) to correct the paths. We have attempted to support the FHS standard # here by placing the HQ Agent files similarly to the way Tripwire 2.3 # places them. # #( # rulename = "Tripwire HQ Connector Data Files", # severity = $(SIG_HI) #) #{ # # # NOTE: Removing the inode attribute because when Tripwire creates a backup # # it does so by renaming the old file and creating a new one (which will # # have a new inode number). Leaving inode turned on for keys, which # # shouldn't ever change. # # # $(TWBIN)/agent.cfg -> $(SEC_BIN) -i ; # $(TWLKEY)/authentication.key -> $(SEC_BIN) ; # $(TWDB)/tasks.dat -> $(SEC_CONFIG) ; # $(TWDB)/schedule.dat -> $(SEC_CONFIG) ; # # # Uncomment if you have agent logging enabled. # #/var/log/tripwire/agent.log -> $(SEC_LOG) ; #} # Commonly accessed directories that should remain static with regards to owner and group ( rulename = "Invariant Directories", severity = $(SIG_MED), emailto = YourEmail@YourDomain.com ) { / -> $(SEC_INVARIANT) (recurse = false) ; } # # First, root's "home" # ( rulename = "Root's home", severity = $(SIG_HI), emailto = YourEmail@YourDomain.com ) { # /.rhosts -> $(SEC_CRIT) ; /.profile -> $(SEC_CRIT) ; /.cshrc -> $(SEC_CRIT) ; # /.exrc -> $(SEC_CRIT) ; # /.logout -> $(SEC_CRIT) ; # /.forward -> $(SEC_CRIT) ; /root -> $(SEC_CRIT) (recurse = true) ; !/root/.history ; !/root/.bash_history ; # !/root/.lsof_SYSTEM_NAME ; # Uncomment if lsof is installed } # # FreeBSD Kernel and boot code # ( rulename = "FreeBSD Kernel", severity = $(SIG_HI), emailto = YourEmail@YourDomain.com ) { /boot -> $(SEC_CRIT) ; } # # System Administration Programs # ( rulename = "System Administration Programs", severity = $(SIG_HI), emailto = YourEmail@YourDomain.com ) { /sbin -> $(SEC_CRIT) (recurse = true) ; /usr/sbin -> $(SEC_CRIT) (recurse = true) ; } # # User Utilities # ( rulename = "User Utilities", severity = $(SIG_HI), emailto = YourEmail@YourDomain.com ) { /bin -> $(SEC_CRIT) (recurse = true) ; /usr/bin -> $(SEC_CRIT) (recurse = true) ; } # # /dev # ( rulename = "/dev", severity = $(SIG_HI), emailto = YourEmail@YourDomain.com ) { } # # /etc # ( rulename = "/etc", severity = $(SIG_HI), emailto = YourEmail@YourDomain.com ) { /etc -> $(SEC_CRIT) (recurse = true) ; # /etc/mail/aliases -> $(SEC_CONFIG) ; /etc/dumpdates -> $(SEC_CONFIG) ; /etc/motd -> $(SEC_CONFIG) ; !/etc/ppp/connect-errors ; } # # Copatibility (Linux) # ( rulename = "Linux Compatibility", severity = $(SIG_HI), emailto = YourEmail@YourDomain.com ) { /compat -> $(SEC_CRIT) (recurse = true) ; # # Uncomment the following if Linux compatibility is used. Replace # HOSTNAME1 and HOSTNAME2 with the hosts that have Linux emulation port # installed. # #@@ifhost HOSTNAME1 || HOSTNAME2 # /compat/linux/etc -> $(SEC_INVARIANT) (recurse = false) ; # /compat/linux/etc/X11 -> $(SEC_CONFIG) (recurse = true) ; # /compat/linux/etc/pam.d -> $(SEC_CONFIG) (recurse = true) ; # /compat/linux/etc/profile.d -> $(SEC_CONFIG) (recurse = true) ; # /compat/linux/etc/real -> $(SEC_CONFIG) (recurse = true) ; # /compat/linux/etc/bashrc -> $(SEC_CONFIG) ; # /compat/linux/etc/csh.login -> $(SEC_CONFIG) ; # /compat/linux/etc/host.conf -> $(SEC_CONFIG) ; # /compat/linux/etc/hosts.allow -> $(SEC_CONFIG) ; # /compat/linux/etc/hosts.deny -> $(SEC_CONFIG) ; # /compat/linux/etc/info-dir -> $(SEC_CONFIG) ; # /compat/linux/etc/inputrc -> $(SEC_CONFIG) ; # /compat/linux/etc/ld.so.conf -> $(SEC_CONFIG) ; # /compat/linux/etc/nsswitch.conf -> $(SEC_CONFIG) ; # /compat/linux/etc/profile -> $(SEC_CONFIG) ; # /compat/linux/etc/redhat-release -> $(SEC_CONFIG) ; # /compat/linux/etc/rpc -> $(SEC_CONFIG) ; # /compat/linux/etc/securetty -> $(SEC_CONFIG) ; # /compat/linux/etc/shells -> $(SEC_CONFIG) ; # /compat/linux/etc/termcap -> $(SEC_CONFIG) ; # /compat/linux/etc/yp.conf -> $(SEC_CONFIG) ; # !/compat/linux/etc/ld.so.cache ; # !/compat/linux/var/spool/mail ; #@@endif } # # Libraries, include files, and other system files # ( rulename = "Libraries, include files, and other system files", severity = $(SIG_HI), emailto = YourEmail@YourDomain.com ) { /usr/include -> $(SEC_CRIT) (recurse = true) ; /usr/lib -> $(SEC_CRIT) (recurse = true) ; /usr/libdata -> $(SEC_CRIT) (recurse = true) ; /usr/libexec -> $(SEC_CRIT) (recurse = true) ; /usr/share -> $(SEC_CRIT) (recurse = true) ; /usr/share/man -> $(SEC_CONFIG) ; !/usr/share/man/whatis ; !/usr/share/man/.glimpse_filenames ; !/usr/share/man/.glimpse_filenames_index ; !/usr/share/man/.glimpse_filetimes ; !/usr/share/man/.glimpse_filters ; !/usr/share/man/.glimpse_index ; !/usr/share/man/.glimpse_messages ; !/usr/share/man/.glimpse_partitions ; !/usr/share/man/.glimpse_statistics ; !/usr/share/man/.glimpse_turbo ; /usr/share/man/man1 -> $(SEC_CRIT) (recurse = true) ; /usr/share/man/man2 -> $(SEC_CRIT) (recurse = true) ; /usr/share/man/man3 -> $(SEC_CRIT) (recurse = true) ; /usr/share/man/man4 -> $(SEC_CRIT) (recurse = true) ; /usr/share/man/man5 -> $(SEC_CRIT) (recurse = true) ; /usr/share/man/man6 -> $(SEC_CRIT) (recurse = true) ; /usr/share/man/man7 -> $(SEC_CRIT) (recurse = true) ; /usr/share/man/man8 -> $(SEC_CRIT) (recurse = true) ; /usr/share/man/man9 -> $(SEC_CRIT) (recurse = true) ; ! /usr/share/man/cat1 ; ! /usr/share/man/cat2 ; ! /usr/share/man/cat3 ; ! /usr/share/man/cat4 ; ! /usr/share/man/cat5 ; ! /usr/share/man/cat6 ; ! /usr/share/man/cat7 ; ! /usr/share/man/cat8 ; ! /usr/share/man/cat9 ; ! /usr/share/man/catl ; ! /usr/share/man/catn ; } # # X11R6 # ( rulename = "X11R6", severity = $(SIG_HI), emailto = YourEmail@YourDomain.com ) { /usr/X11R6 -> $(SEC_CRIT) (recurse = true) ; !/usr/X11R6/lib/X11/xdm/xdm-errors ; !/usr/X11R6/lib/X11/xdm/authdir/authfiles ; !/usr/X11R6/lib/X11/xdm/xdm-pid ; #!/usr/X11R6/lib/X11/xkb/compiled -> $(SEC_CONFIG) (recurse = true) ; /usr/X11R6/man -> $(SEC_CONFIG) ; !/usr/X11R6/man/whatis ; !/usr/X11R6/man/.glimpse_filenames ; !/usr/X11R6/man/.glimpse_filenames_index ; !/usr/X11R6/man/.glimpse_filetimes ; !/usr/X11R6/man/.glimpse_filters ; !/usr/X11R6/man/.glimpse_index ; !/usr/X11R6/man/.glimpse_messages ; !/usr/X11R6/man/.glimpse_partitions ; !/usr/X11R6/man/.glimpse_statistics ; !/usr/X11R6/man/.glimpse_turbo ; /usr/X11R6/man/man1 -> $(SEC_CRIT) (recurse = true) ; /usr/X11R6/man/man2 -> $(SEC_CRIT) (recurse = true) ; /usr/X11R6/man/man3 -> $(SEC_CRIT) (recurse = true) ; /usr/X11R6/man/man4 -> $(SEC_CRIT) (recurse = true) ; /usr/X11R6/man/man5 -> $(SEC_CRIT) (recurse = true) ; /usr/X11R6/man/man6 -> $(SEC_CRIT) (recurse = true) ; /usr/X11R6/man/man7 -> $(SEC_CRIT) (recurse = true) ; /usr/X11R6/man/man8 -> $(SEC_CRIT) (recurse = true) ; /usr/X11R6/man/man9 -> $(SEC_CRIT) (recurse = true) ; /usr/X11R6/man/manl -> $(SEC_CRIT) (recurse = true) ; /usr/X11R6/man/mann -> $(SEC_CRIT) (recurse = true) ; ! /usr/X11R6/man/cat1 ; ! /usr/X11R6/man/cat2 ; ! /usr/X11R6/man/cat3 ; ! /usr/X11R6/man/cat4 ; ! /usr/X11R6/man/cat5 ; ! /usr/X11R6/man/cat6 ; ! /usr/X11R6/man/cat7 ; ! /usr/X11R6/man/cat8 ; ! /usr/X11R6/man/cat9 ; ! /usr/X11R6/man/catl ; ! /usr/X11R6/man/catn ; } # # sources # ( rulename = "Sources", severity = $(SIG_HI), emailto = YourEmail@YourDomain.com ) { /usr/src -> $(SEC_CRIT) (recurse = true) ; } # # NIS # ( rulename = "NIS", severity = $(SIG_HI), emailto = YourEmail@YourDomain.com ) { /var/yp -> $(SEC_CRIT) (recurse = true) ; !/var/yp/binding ; } # # Temporary directories # ( rulename = "Temporary directories", recurse = false, severity = $(SIG_LOW), emailto = YourEmail@YourDomain.com ) { /var/tmp -> $(SEC_INVARIANT) ; /var/preserve -> $(SEC_INVARIANT) ; /tmp -> $(SEC_INVARIANT) ; /opt -> $(SEC_INVARIANT) (recurse = true) ; } # # Local files # ( rulename = "Local files", severity = $(SIG_MED), emailto = YourEmail@YourDomain.com ) { /usr/local/bin -> $(SEC_BIN) (recurse = true) ; /usr/local/sbin -> $(SEC_BIN) (recurse = true) ; /usr/local/etc -> $(SEC_BIN) (recurse = true) ; /usr/local/lib -> $(SEC_BIN) (recurse = true ) ; /usr/local/libexec -> $(SEC_BIN) (recurse = true ) ; /usr/local/share -> $(SEC_BIN) (recurse = true ) ; /usr/local/man -> $(SEC_CONFIG) ; !/usr/local/man/whatis ; !/usr/local/man/.glimpse_filenames ; !/usr/local/man/.glimpse_filenames_index ; !/usr/local/man/.glimpse_filetimes ; !/usr/local/man/.glimpse_filters ; !/usr/local/man/.glimpse_index ; !/usr/local/man/.glimpse_messages ; !/usr/local/man/.glimpse_partitions ; !/usr/local/man/.glimpse_statistics ; !/usr/local/man/.glimpse_turbo ; /usr/local/man/man1 -> $(SEC_CRIT) (recurse = true) ; /usr/local/man/man2 -> $(SEC_CRIT) (recurse = true) ; /usr/local/man/man3 -> $(SEC_CRIT) (recurse = true) ; /usr/local/man/man4 -> $(SEC_CRIT) (recurse = true) ; /usr/local/man/man5 -> $(SEC_CRIT) (recurse = true) ; /usr/local/man/man6 -> $(SEC_CRIT) (recurse = true) ; /usr/local/man/man7 -> $(SEC_CRIT) (recurse = true) ; /usr/local/man/man8 -> $(SEC_CRIT) (recurse = true) ; /usr/local/man/man9 -> $(SEC_CRIT) (recurse = true) ; /usr/local/man/manl -> $(SEC_CRIT) (recurse = true) ; /usr/local/man/mann -> $(SEC_CRIT) (recurse = true) ; ! /usr/local/man/cat1 ; ! /usr/local/man/cat2 ; ! /usr/local/man/cat3 ; ! /usr/local/man/cat4 ; ! /usr/local/man/cat5 ; ! /usr/local/man/cat6 ; ! /usr/local/man/cat7 ; ! /usr/local/man/cat8 ; ! /usr/local/man/cat9 ; ! /usr/local/man/catl ; ! /usr/local/man/catn ; !/usr/local/krb5/man/whatis ; !/usr/local/krb5/man/.glimpse_filenames ; !/usr/local/krb5/man/.glimpse_filenames_index ; !/usr/local/krb5/man/.glimpse_filetimes ; !/usr/local/krb5/man/.glimpse_filters ; !/usr/local/krb5/man/.glimpse_index ; !/usr/local/krb5/man/.glimpse_messages ; !/usr/local/krb5/man/.glimpse_partitions ; !/usr/local/krb5/man/.glimpse_statistics ; !/usr/local/krb5/man/.glimpse_turbo ; ! /usr/local/krb5/man/cat1 ; ! /usr/local/krb5/man/cat2 ; ! /usr/local/krb5/man/cat3 ; ! /usr/local/krb5/man/cat4 ; ! /usr/local/krb5/man/cat5 ; ! /usr/local/krb5/man/cat6 ; ! /usr/local/krb5/man/cat7 ; ! /usr/local/krb5/man/cat8 ; ! /usr/local/krb5/man/cat9 ; ! /usr/local/krb5/man/catl ; ! /usr/local/krb5/man/catn ; /usr/local/www -> $(SEC_CONFIG) (recurse = true) ; } ( rulename = "Security Control", severity = $(SIG_HI), emailto = YourEmail@YourDomain.com ) { /etc/group -> $(SEC_CRIT) ; /etc/crontab -> $(SEC_CRIT) ; }

# Update your site policy
/usr/local/sbin/twadmin --create-polfile -S /usr/local/etc/tripwire/site.key /usr/local/etc/tripwire/twpol.txt

# Create a new database
/usr/local/sbin/tripwire --init

# Make sure tripwire runs daily
cp /usr/ports/security/tripwire/work/tripwire-2.4.0.1/contrib/tripwire-check /etc/periodic/daily/998.tripwire-check
chmod +x /etc/periodic/daily/998.tripwire-check
# Edit the default script and fix two lines!
vi /etc/periodic/daily/998.tripwire-check
TWCFG_PATH=/usr/local/etc/tripwire TWDB_PATH=/var/db/tripwire

# Run tripwire manually as desired (try it at least once now)
/usr/local/sbin/tripwire --check

# Tripwire Reports (*.twr) are kept here: /var/db/tripwire/report/
# Get a list of your reports
ls /var/db/tripwire/report
# View a report
/usr/local/sbin/twprint -m r --twrfile /var/db/tripwire/report/<name>.twr

# NOTE: After you see your first report, you will want to cleanup tripwire's configuration
# to stop checking for things that don't exist, this means deleting lines in twpol.txt
vi /usr/local/etc/tripwire/twpol.txt
# You will then need to update your policy file and create a new database again
/usr/local/sbin/twadmin --create-polfile -S /usr/local/etc/tripwire/site.key /usr/local/etc/tripwire/twpol.txt
/usr/local/sbin/tripwire --init
# Run tripwire manually again and view the new report to verify your policy is error free
/usr/local/sbin/tripwire --check

# Clean up the install directory
cd /usr/ports/security/tripwire
make clean

# Guide: http://www.redhat.com/docs/manuals/linux/RHL-9-Manual/ref-guide/ch-tripwire.html