@cdmonkey 2021-06-09T05:43:59.000000Z 字数 8720 阅读 1245

tripwire

开源工具

https://linux.cn/article-3528-1.html
http://www.linuxfly.org/post/133/1/1/
http://www.freebuf.com/articles/system/19208.html
http://www.ibm.com/developerworks/cn/aix/library/au-usingtripwire

http://www.linuxfromscratch.org/blfs/view/svn/postlfs/tripwire.html
https://www.ibm.com/developerworks/aix/library/au-usingtripwire/index.html

其能够对要求校验的系统文件进行类似md5的运行，而生成一个唯一的标识，即“快照（snapshot）”。当这部分系统文件的大小、inode号、权限、时间等任意属性被修改后，再次运行该工具，其会进行前后属性的对比，并生成相关的详细报告。

[root@svn-test tripwire-2.4.2.2-src]# ./configure --prefix=/usr/local/tripwire

./configure --prefix=/usr/local/tripwire
make
make install
# 从这里开始就会有一些需要安装着手动输入的内容。
LICENSE AGREEMENT for Tripwire(R) 2.4 Open Source
Please read the following license agreement.  You must accept the
agreement to continue installing Tripwire.
Press ENTER to view the License Agreement.
...
Please type "accept" to indicate your acceptance of this
license agreement. [do not accept]
...
This program will copy Tripwire files to the following directories:
        TWBIN: /usr/local/tripwire/sbin
        TWMAN: /usr/local/tripwire/man
     TWPOLICY: /usr/local/tripwire/etc
     TWREPORT: /usr/local/tripwire/lib/tripwire/report
         TWDB: /usr/local/tripwire/lib/tripwire
 TWSITEKEYDIR: /usr/local/tripwire/etc
TWLOCALKEYDIR: /usr/local/tripwire/etc
CLOBBER is false.
Continue with installation? [y/n] 
...
Creating key files...
(When selecting a passphrase, keep in mind that good passphrases typically
have upper and lower case letters, digits and punctuation marks, and are
at least 8 characters in length.)
Enter the site keyfile passphrase:

Configure Tripwire

安装完成后会于设定文件目录下创建密钥文件、设定文件以及使用密钥加密后的设定文件。

[root@svn-test ~]# ls /usr/local/tripwire/etc/ |sort
site.key
svn-test-local.key
tw.cfg
twcfg.txt     # 设定文件：定义数据库、策略文件及软件的可执行文件的位置。
tw.pol
twpol.txt     # 策略文件：定义检测的对象以及出现问题时采取的行为。

[root@svn-test etc]# vim twcfg.txt 
ROOT          =/usr/local/tripwire/sbin
POLFILE       =/usr/local/tripwire/etc/tw.pol
DBFILE        =/usr/local/tripwire/lib/tripwire/$(HOSTNAME).twd
REPORTFILE    =/usr/local/tripwire/lib/tripwire/report/$(HOSTNAME)-$(DATE).twr
SITEKEYFILE   =/usr/local/tripwire/etc/site.key
LOCALKEYFILE  =/usr/local/tripwire/etc/svn-test-local.key
EDITOR        =/bin/vi
LATEPROMPTING =false
LOOSEDIRECTORYCHECKING =false
MAILNOVIOLATIONS =true
EMAILREPORTLEVEL =3
REPORTLEVEL   =3
MAILMETHOD    =SENDMAIL
SYSLOGREPORTING =false
MAILPROGRAM   =/usr/sbin/sendmail -oi -t

Generating key

Create site-key

[root@svn-test ~]# cd /usr/local/tripwire/sbin/
./twadmin --generate-keys --site-keyfile /usr/local/tripwire/etc/site.key

Create local-key

[root@svn-test ~]# cd /usr/local/tripwire/sbin/
./twadmin --generate-keys --site-keyfile /usr/local/tripwire/etc/`hostname`-local.key

Configuration file signature

Create Database

Tripwire的数据库是基于Policy文件建立的。但默认的Policy文件并没有有效的依照我们的需要建立数据完整性监测规则，所以这里通过一段Perl脚本来让数据监测实际满足于我们的需要。

Encryption policy file

我们更新策略原始文件后需要重新进行签名并创建新的策略文件：

[root@svn-test ~]# cd /usr/local/tripwire/etc/
[root@svn-test etc]# ../sbin/twadmin --create-polfile -S site.key twpol.txt 
Please enter your site passphrase: 
Wrote policy file: /usr/local/tripwire/etc/tw.pol

../sbin/twadmin -m F -c tw.cfg -S site.key twcfg.txt

Display encryption policy file

我么能够使用下面的指令来显示策略文件的内容，从而确认“Tripwire”已经创建了新更新的策略文件。

[root@svn-test ~]# /usr/local/tripwire/sbin/twadmin --print-polfile

修改完策略文件后，可使用“Tripwire”进行一次初始完整性扫描并生成新的数据库。如果已经有了数据库，于运行初始化扫描之前，首先移除原来的文件是一个好习惯，可确保有一个干净的数据库版本。

# Delete old database files:
[root@svn-test ~]# rm /usr/local/tripwire/lib/tripwire/svn-test.twd
# Scan and re-create database files:
[root@svn-test ~]# /usr/local/tripwire/sbin/tripwire --init
Please enter your local passphrase: 
Parsing policy file: /usr/local/tripwire/etc/tw.pol
Generating the database...
*** Processing Unix File System ***
Wrote database file: /usr/local/tripwire/lib/tripwire/svn-test.twd
The database was successfully generated.

至此于系统上使用新的策略文件进行完整性检测后其输出的结果：

[root@svn-test ~]# /usr/local/tripwire/sbin/tripwire --check
Parsing policy file: /usr/local/tripwire/etc/tw.pol
*** Processing Unix File System ***
Performing integrity check...
Wrote report file: /usr/local/tripwire/lib/tripwire/report/svn-test-20160701-102520.twr
Open Source Tripwire(R) 2.4.2.2 Integrity Check Report
Report generated by:          root
Report created on:            Fri Jul  1 10:25:20 2016
Database last updated on:     Never
===============================================================================
Report Summary:
===============================================================================
Host name:                    svn-test
Host IP address:              172.16.138.11
Host ID:                      None
Policy file used:             /usr/local/tripwire/etc/tw.pol
Configuration file used:      /usr/local/tripwire/etc/tw.cfg
Database file used:           /usr/local/tripwire/lib/tripwire/svn-test.twd
Command line used:            /usr/local/tripwire/sbin/tripwire --check 
===============================================================================
Rule Summary: 
===============================================================================
-------------------------------------------------------------------------------
  Section: Unix File System
-------------------------------------------------------------------------------
  Rule Name                       Severity Level    Added    Removed  Modified 
  ---------                       --------------    -----    -------  -------- 
* Tripwire Data Files             0                 1        0        0        
* Monitor Filesystems             0                 0        0        2        
  Tripwire Binaries               0                 0        0        0        
  User Binaries and Libraries     0                 0        0        0        
  Global Configuration Files      0                 0        0        0        
  RPM Checksum Files              0                 0        0        0        
Total objects scanned:  78177
Total violations found:  3
===============================================================================
Object Summary: 
===============================================================================
-------------------------------------------------------------------------------
# Section: Unix File System
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
Rule Name: Tripwire Data Files (/usr/local/tripwire/lib/tripwire)
Severity Level: 0
-------------------------------------------------------------------------------
Added:
"/usr/local/tripwire/lib/tripwire/svn-test.twd"
-------------------------------------------------------------------------------
Rule Name: Monitor Filesystems (/var)
Severity Level: 0
-------------------------------------------------------------------------------
Modified:
"/var/log/cron"
"/var/log/sa/sa01"
===============================================================================
Error Report: 
===============================================================================
No Errors
-------------------------------------------------------------------------------
*** End of report ***
Open Source Tripwire 2.4 Portions copyright 2000 Tripwire, Inc. Tripwire is a registered
trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;
for details use --version. This is free software which may be redistributed
or modified only under certain conditions; see COPYING for details.
All rights reserved.
Integrity check complete.

Check and repair the damage

从上面的监测结果看，使用我们特制的策略文件，没有报出任何错误。

Policy File

[root@svn-test ~]# cat /usr/local/tripwire/etc/twpol.txt 
########## Policy file for Red Hat Linux ##########
# Global Variable Definitions
@@section GLOBAL
TWDOCS="/usr/local/tripwire/doc/tripwire";
TWBIN="/usr/local/tripwire/sbin";
TWPOL="/usr/local/tripwire/etc";
TWDB="/usr/local/tripwire/lib/tripwire";
TWSKEY="/usr/local/tripwire/etc";
TWLKEY="/usr/local/tripwire/etc";
TWREPORT="/usr/local/tripwire/lib/tripwire/report";
HOSTNAME=svn-test;
# Predefined Variables
Device        = +pugsdr-intlbamcCMSH ;
Dynamic       = +pinugtd-srlbamcCMSH ;
Growing       = +pinugtdl-srbamcCMSH ;
IgnoreAll     = -pinugtsdrlbamcCMSH ;
IgnoreNone    = +pinugtsdrbamcCMSH-l ;
ReadOnly      = +pinugtsdbmCM-rlacSH ;
Temporary     = +pugt ;
@@section FS
# Tripwire Binaries and Data Files
# Tripwire Binaries
(
  rulename = "Tripwire Binaries",
)
{
  $(TWBIN)/siggen                      -> $(ReadOnly) ;
  $(TWBIN)/tripwire                    -> $(ReadOnly) ;
  $(TWBIN)/twadmin                     -> $(ReadOnly) ;
  $(TWBIN)/twprint                     -> $(ReadOnly) ;
}
# Tripwire Data Files - Configuration Files, Policy Files, Keys, Reports, Databases
(
  rulename = "Tripwire Data Files",
)
{
  $(TWDB)                              -> $(Dynamic) -i ;
  $(TWPOL)/tw.pol                      -> $(ReadOnly) -i ;
  $(TWPOL)/tw.cfg                      -> $(ReadOnly) -i ;
  $(TWLKEY)/$(HOSTNAME)-local.key      -> $(ReadOnly) ;
  $(TWSKEY)/site.key                   -> $(ReadOnly) ;
  $(TWREPORT)                          -> $(Dynamic) (recurse=0) ;
}
# User Binaries and Libraries
( 
  rulename = "User Binaries and Libraries",
)
{ 
  /usr/local/bin                -> $(ReadOnly) ;
  /usr/local/include            -> $(ReadOnly) ;
  /usr/local/lib                -> $(ReadOnly) ;
  /usr/local/libexec            -> $(ReadOnly) ;
  /usr/local/sbin               -> $(ReadOnly) ;
}
# Global Configuration Files (/etc/)
(
  rulename = "Global Configuration Files",
)
{
  /etc                           -> $(IgnoreNone) -SHa ;
  /etc/bashrc                    -> $(Dynamic) ;
  /etc/profile                   -> $(Dynamic) -i ;
  /etc/rc.d                      -> $(IgnoreNone) -SHa ;
  /etc/sysconfig                 -> $(IgnoreNone) -SHa ;
}
# Monitor Filesystems
(
  rulename = "Monitor Filesystems",
)
{
  /usr                          -> $(ReadOnly) ;
  /var                          -> $(ReadOnly) ;
}

Email

/usr/local/tripwire/sbin/tripwire --check|mailx -s "Tripwire Report for `hostname`" wang_hz@suixingpay.com

排错

不小心把tw.cfg以及tw.pol文件移除了。

[root@PBSWeChat02 etc]# /usr/local/tripwire/sbin/tripwire --init
### Error: File could not be opened.
### Filename: /usr/local/tripwire/etc/tw.cfg
### \xe6\xb2\xa1\xe6\x9c\x89\xe9\x82\xa3\xe4\xb8\xaa\xe6\x96\x87\xe4\xbb\xb6\xe6\x88\x96\xe7\x9b\xae\xe5\xbd\x95
### Configuration file could not be read.
### Exiting...

解决方法：

[root@PBSWeChat02 etc]# ../sbin/twadmin -m F -c tw.cfg -S site.key twcfg.txt
[root@PBSWeChat02 etc]# ../sbin/twadmin -m P -c tw.cfg -p tw.pol -S site.key twpol.txt