Monitoring file integrity with FC4 - Tripwire??

[Ian]

I'd never heard of Tripwire before, but it sounds like the ultimate 
virus defence to me. Can it stop programs from running if they have been 
changed without Tripwire being told? Or do you just get told when a file 
has been modified (via the cron job, by which time it's probably too late)?
The second thought that occurred to me was that, if a virus was trying 
to modify system files, wouldn't it also attempt to update the Tripwire 
database to match, so Tripwire wouldn't flag the change? Could that be 
prevented? Does Tripwire monitor itself???
Ian


Scot L. Harris wrote:

>On Thu, 2005-09-29 at 14:34, Hahnel William J (CI) wrote:
>  
>
>>I'm looking for a mechanism to monitor the integrity of critical files
>>on my FC4 servers.  I understand Tripwire is the application to do it
>>but I am having no success getting it set up.  I downloaded the source
>>from SourceForge but can not follow how to set it up.  I could not
>>locate an RPM for the application.
>> 
>>Any help getting something set up would be greatly appreciated.
>> 
>>Thanks!
>> 
>>Bill Hahnel
>>CI National Operations Center
>>    
>>
>
>You should find a tripwire rpm in the extras repository for Fedora.
>
>Note: the setup script is now located in
>/usr/sbin/tripwire-setup-keyfiles.  It explains this in one of the
>readme files that comes with the rpm.  That file will setup the key
>files for your system.  You will need to edit the policy file to get
>things configured the way you want and to eliminate items which are not
>installed on your system or which you don't want to monitor.  Then run
>through the normal steps for setting up the database and running the
>report.  
>
>One alternative to tripwire is AIDE.  The last time I looked at it
>though it seemed to be immature and not quite ready.  It did not sign
>the policy or database files which means to setup this up in a secure
>manner you would have to arrange to keep those files off line or on read
>only media.  
>
>I personally prefer tripwire.  I always found this RedHat documentation
>to be useful when setting up or updating tripwire:
>
>http://www.redhat.com/docs/manuals/linux/RHL-7.3-Manual/ref-guide/ch-tripwire.html
>
>The only real change from those docs to now is the initialization script
>which is /usr/sbin/tripwire-setup-keyfiles now.
>
>I also came across this posting.  I have not tried this script but if it
>does what it claims it could be very useful.  As always I would
>recommend you manually check the policy file to make sure it is
>monitoring the files you want on your system.
>
>http://moongroup.com/pipermail/shell.scripting/2004-March/000849.html
>
>If you use that script and it works let us know.
>
>
>  
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/fedora-list/attachments/20051001/6e334e30/attachment-0001.htm>