本文是一篇关于 Debian 中安装和配置 tripewire 的文章。它是 Linux 环境下基于主机的入侵检测系统（IDS）。tripwire 的高级功能可以检测并报告任何 Linux 中未授权的（文件和目录）的更改。tripewire 安装之后，会先创建一个基本的数据库，tripewire 监控并检测新文件的创建修改和谁修改了它等等。如果修改是合法的，你可以接受修改并更新 tripwire 的数据库。

安装和配置

tripwire 在 Debian VM 中的安装如下。

1. # apt-get install tripwire

installation

安装中，tripwire 会有下面的配置提示。

站点密钥创建

tripwire 需要一个站点口令（site passphrase）来加密 tripwire 的配置文件 tw.cfg 和策略文件 tw.pol。tripewire 使用指定的密码加密两个文件。一个 tripewire 实例必须指定站点口令。

site key1

本地密钥口令

本地口令用来保护 tripwire 数据库和报告文件。本地密钥用于阻止非授权的 tripewire 数据库修改。

local key1

tripwire 配置路径

tripewire 配置存储在 /etc/tripwire/twcfg.txt。它用于生成加密的配置文件 tw.cfg。

configuration file

tripwire 策略路径

tripwire 在 /etc/tripwire/twpol.txt 中保存策略文件。它用于生成加密的策略文件 tw.pol。

tripwire policy

安装完成后如下图所示。

installed tripewire1

tripwire 配置文件 (twcfg.txt)

tripewire 配置文件（twcfg.txt）细节如下图所示。加密策略文件（tw.pol）、站点密钥（site.key）和本地密钥（hostname-local.key）在后面展示。

1. ROOT =/usr/sbin
2.  
3. POLFILE =/etc/tripwire/tw.pol
4.  
5. DBFILE =/var/lib/tripwire/$(HOSTNAME).twd
6.  
7. REPORTFILE =/var/lib/tripwire/report/$(HOSTNAME)-$(DATE).twr
8.  
9. SITEKEYFILE =/etc/tripwire/site.key
10.  
11. LOCALKEYFILE =/etc/tripwire/$(HOSTNAME)-local.key
12.  
13. EDITOR =/usr/bin/editor
14.  
15. LATEPROMPTING =false
16.  
17. LOOSEDIRECTORYCHECKING =false
18.  
19. MAILNOVIOLATIONS =true
20.  
21. EMAILREPORTLEVEL =3
22.  
23. REPORTLEVEL =3
24.  
25. SYSLOGREPORTING =true
26.  
27. MAILMETHOD =SMTP
28.  
29. SMTPHOST =localhost
30.  
31. SMTPPORT =25
32.  
33. TEMPDIRECTORY =/tmp

tripwire 策略配置

在生成基础数据库之前先配置 tripwire 配置。有必要经用一些策略如 /dev、 /proc 、/root/mail 等。详细的 twpol.txt 策略文件如下所示。

1. @@section GLOBAL
2. TWBIN = /usr/sbin;
3. TWETC = /etc/tripwire;
4. TWVAR = /var/lib/tripwire;
5.  
6. #
7. # File System Definitions
8. #
9. @@section FS
10.  
11. #
12. # First, some variables to make configuration easier
13. #
14. SEC_CRIT = $(IgnoreNone)-SHa ; # Critical files that cannot change
15.  
16. SEC_BIN = $(ReadOnly) ; # Binaries that should not change
17.  
18. SEC_CONFIG = $(Dynamic) ; # Config files that are changed
19. # infrequently but accessed
20. # often
21.  
22. SEC_LOG = $(Growing) ; # Files that grow, but that
23. # should never change ownership
24.  
25. SEC_INVARIANT = +tpug ; # Directories that should never
26. # change permission or ownership
27.  
28. SIG_LOW = 33 ; # Non-critical files that are of
29. # minimal security impact
30.  
31. SIG_MED = 66 ; # Non-critical files that are of
32. # significant security impact
33.  
34. SIG_HI = 100 ; # Critical files that are
35. # significant points of
36. # vulnerability
37.  
38. #
39. # tripwire Binaries
40. #
41. (
42. rulename = "tripwire Binaries",
43. severity = $(SIG_HI)
44. )
45. {
46. $(TWBIN)/siggen -> $(SEC_BIN) ;
47. $(TWBIN)/tripwire -> $(SEC_BIN) ;
48. $(TWBIN)/twadmin -> $(SEC_BIN) ;
49. $(TWBIN)/twprint -> $(SEC_BIN) ;
50. }
51. {
52. /boot -> $(SEC_CRIT) ;
53. /lib/modules -> $(SEC_CRIT) ;
54. }
55.  
56. (
57. rulename = "Boot Scripts",
58. severity = $(SIG_HI)
59. )
60. {
61. /etc/init.d -> $(SEC_BIN) ;
62. #/etc/rc.boot -> $(SEC_BIN) ;
63. /etc/rcS.d -> $(SEC_BIN) ;
64. /etc/rc0.d -> $(SEC_BIN) ;
65. /etc/rc1.d -> $(SEC_BIN) ;
66. /etc/rc2.d -> $(SEC_BIN) ;
67. /etc/rc3.d -> $(SEC_BIN) ;
68. /etc/rc4.d -> $(SEC_BIN) ;
69. /etc/rc5.d -> $(SEC_BIN) ;
70. /etc/rc6.d -> $(SEC_BIN) ;
71. }
72.  
73. (
74. rulename = "Root file-system executables",
75. severity = $(SIG_HI)
76. )
77. {
78. /bin -> $(SEC_BIN) ;
79. /sbin -> $(SEC_BIN) ;
80. }
81.  
82. #
83. # Critical Libraries
84. #
85. (
86. rulename = "Root file-system libraries",
87. severity = $(SIG_HI)
88. )
89. {
90. /lib -> $(SEC_BIN) ;
91. }
92.  
93. #
94. # Login and Privilege Raising Programs
95. #
96. (
97. rulename = "Security Control",
98. severity = $(SIG_MED)
99. )
100. {
101. /etc/passwd -> $(SEC_CONFIG) ;
102. /etc/shadow -> $(SEC_CONFIG) ;
103. }
104. {
105. #/var/lock -> $(SEC_CONFIG) ;
106. #/var/run -> $(SEC_CONFIG) ; # daemon PIDs
107. /var/log -> $(SEC_CONFIG) ;
108. }
109.  
110. # These files change the behavior of the root account
111. (
112. rulename = "Root config files",
113. severity = 100
114. )
115. {
116. /root -> $(SEC_CRIT) ; # Catch all additions to /root
117. #/root/mail -> $(SEC_CONFIG) ;
118. #/root/Mail -> $(SEC_CONFIG) ;
119. /root/.xsession-errors -> $(SEC_CONFIG) ;
120. #/root/.xauth -> $(SEC_CONFIG) ;
121. #/root/.tcshrc -> $(SEC_CONFIG) ;
122. #/root/.sawfish -> $(SEC_CONFIG) ;
123. #/root/.pinerc -> $(SEC_CONFIG) ;
124. #/root/.mc -> $(SEC_CONFIG) ;
125. #/root/.gnome_private -> $(SEC_CONFIG) ;
126. #/root/.gnome-desktop -> $(SEC_CONFIG) ;
127. #/root/.gnome -> $(SEC_CONFIG) ;
128. #/root/.esd_auth -> $(SEC_CONFIG) ;
129. # /root/.elm -> $(SEC_CONFIG) ;
130. #/root/.cshrc -> $(SEC_CONFIG) ;
131. #/root/.bashrc -> $(SEC_CONFIG) ;
132. #/root/.bash_profile -> $(SEC_CONFIG) ;
133. # /root/.bash_logout -> $(SEC_CONFIG) ;
134. #/root/.bash_history -> $(SEC_CONFIG) ;
135. #/root/.amandahosts -> $(SEC_CONFIG) ;
136. #/root/.addressbook.lu -> $(SEC_CONFIG) ;
137. #/root/.addressbook -> $(SEC_CONFIG) ;
138. #/root/.Xresources -> $(SEC_CONFIG) ;
139. #/root/.Xauthority -> $(SEC_CONFIG) -i ; # Changes Inode number on login
140. /root/.ICEauthority -> $(SEC_CONFIG) ;
141. }
142.  
143. #
144. # Critical devices
145. #
146. (
147. rulename = "Devices & Kernel information",
148. severity = $(SIG_HI),
149. )
150. {
151. #/dev -> $(Device) ;
152. #/proc -> $(Device) ;
153. }

tripwire 报告

tripwire-check 命令检查 twpol.txt 文件并基于此文件生成 tripwire 报告如下。如果 twpol.txt 中有任何错误，tripwire 不会生成报告。

tripwire report

文本形式报告

1. root@VMdebian:/home/labadmin# tripwire --check
2.  
3. Parsing policy file: /etc/tripwire/tw.pol
4.  
5. *** Processing Unix File System ***
6.  
7. Performing integrity check...
8.  
9. Wrote report file: /var/lib/tripwire/report/VMdebian-20151024-122322.twr
10.  
11. Open Source tripwire(R) 2.4.2.2 Integrity Check Report
12.  
13. Report generated by: root
14.  
15. Report created on: Sat Oct 24 12:23:22 2015
16.  
17. Database last updated on: Never
18.  
19. Report Summary:
20.  
21. =========================================================
22.  
23. Host name: VMdebian
24.  
25. Host IP address: 127.0.1.1
26.  
27. Host ID: None
28.  
29. Policy file used: /etc/tripwire/tw.pol
30.  
31. Configuration file used: /etc/tripwire/tw.cfg
32.  
33. Database file used: /var/lib/tripwire/VMdebian.twd
34.  
35. Command line used: tripwire --check
36.  
37. =========================================================
38.  
39. Rule Summary:
40.  
41. =========================================================
42.  
43. -------------------------------------------------------------------------------
44.  
45. Section: Unix File System
46.  
47. -------------------------------------------------------------------------------
48.  
49. Rule Name Severity Level Added Removed Modified
50.  
51. --------- -------------- ----- ------- --------
52.  
53. Other binaries 66 0 0 0
54.  
55. tripwire Binaries 100 0 0 0
56.  
57. Other libraries 66 0 0 0
58.  
59. Root file-system executables 100 0 0 0
60.  
61. tripwire Data Files 100 0 0 0
62.  
63. System boot changes 100 0 0 0
64.  
65. (/var/log)
66.  
67. Root file-system libraries 100 0 0 0
68.  
69. (/lib)
70.  
71. Critical system boot files 100 0 0 0
72.  
73. Other configuration files 66 0 0 0
74.  
75. (/etc)
76.  
77. Boot Scripts 100 0 0 0
78.  
79. Security Control 66 0 0 0
80.  
81. Root config files 100 0 0 0
82.  
83. Invariant Directories 66 0 0 0
84.  
85. Total objects scanned: 25943
86.  
87. Total violations found: 0
88.  
89. =========================Object Summary:================================
90.  
91. -------------------------------------------------------------------------------
92.  
93. # Section: Unix File System
94.  
95. -------------------------------------------------------------------------------
96.  
97. No violations.
98.  
99. ===========================Error Report:=====================================
100.  
101. No Errors
102.  
103. -------------------------------------------------------------------------------
104.  
105. *** End of report ***
106.  
107. Open Source tripwire 2.4 Portions copyright 2000 tripwire, Inc. tripwire is a registered
108.  
109. trademark of tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;
110.  
111. for details use --version. This is free software which may be redistributed
112.  
113. or modified only under certain conditions; see COPYING for details.
114.  
115. All rights reserved.
116.  
117. Integrity check complete.

总结

本篇中，我们学习安装配置开源入侵检测软件 tripwire。首先生成基础数据库并通过比较检测出任何改动（文件/文件夹）。然而，tripwire 并不是实时监测的 IDS。