Configuring basic Tripwire server
Tripwire uses two types of keys, site key and local key. Site key can be used to protect files which are common across site like configuration file and policy file. Local key is used to protect files which are specific to a machine, like tripwire database.
Generating tripwire keys
To generate keys we can use:
twadmin --generate-keys --site-keyfile /etc/tripwire/site.key --local-keyfile /etc/tripwire/<hostname>-local.key
twadmin --generate-keys --site-keyfile /etc/tripwire/site.key --local-keyfile /etc/tripwire/labpc-local.key
Note that it is not necessary that we generate both type of keys. We can generate just one type of key if we want. Tripwire would ask us to enter passphrase for keys that we are trying to generate. These passphrase would be required whenever we want to sign something with these keys.
Tripwire configuration file
Tripwire configuration file contains locations of key files, tripwire database, whether reports should be mailed etc. configuration parameters. To create tripwire configuration file we specify all parameters in a text file, typically 'twcfg.txt' and then sign this with site key to create signed configuration file, typically 'tw.cfg'.
Tripwire configuration file uses 'variable=value' format and we can use value of a variable to define values of other variables using $(variable) syntax. All variables defined in this file are case-sensitive.
Required variables are:
|Description and default value
|Tripwire encrypted policy file location.
|Tripwire database file location.
|Tripwire report file location.
|Site key to be used to sign policy and configuration files.
|Local key to be used to sign database and reports.
Note: If we use above values in our configuration file then we should ensure directory '/var/lib/tripwire/report' exists. Also we should do 'chmod -R 700 /var/lib/tripwire'
In CentOS 5.5 it makes sense to define these additional variables
|Description and example value
|Directory where tripwire should create temporary files while it is working. The default value is '/tmp' which is not very secure. We should create a directory with 700 permissions and set value of this variable to that directory.
Example value: '/etc/tripwire/temp'. We have to ensure that we create this directory and also exclude it being checked in tripwire policy file.
|Email address where tripwire reports are sent when we run check with '--email-report' option.
Example value: 'email@example.com'
|Mail method to be used to send email. It can be either SMTP or SENDMAIL. In case of SENDMAIL the local sendmail should have been configured properly so that it can send emails to emails address specified in policy file or in GLOBALEMAIL. If MAILMETHOD has value SMTP then we need to define two additional variables SMTPHOST and SMTPPORT. In case it is SENDMAIL, then we need to define MAILPROGRAM variable. Unless we define this variable in configuration file, the email feature will not work.
Example value: 'SENDMAIL'
|Location of program which can take email data along with headers and send email. The program should not stop reading if a line containing only dot(.) is encountered.
Example : '/usr/sbin/sendmail -oi -t'
|Specifies the domain name or IP address of the SMTP server used for email notification.
Example value : 'smtp.example.com'
|Specifies the port number used with SMTP.
Example value: '25'
Creating signed tripwire configuration file
We can create signed tripwire configuration file using:
twadmin --create-cfgfile --cfgfile /etc/tripwire/tw.cfg --site-keyfile /etc/tripwire/site.key /etc/tripwire/twcfg.txt
Printing configuration file
We can print tripwire configuration file using:
twadmin --print-cfgfile --cfgfile /etc/tripwire/tw.cfg
Same as in case of tripwire configuration file, we have two tripwire policy files. We first create plain-text policy file, typically 'twpol.txt' and then encode/sign it with site key file to get signed and encoded policy file, typically 'tw.pol'. We can learn about tripwire policy file format from 'man twpolicy' page. We can also learn from default policy file 'twpol.txt' to learn about tripwire policy file format. This default file also serves as good starting point for creating our own custom tailored policy files.
Note that in case we have specified our own temporary files location in tripwire configuration other than the default '/tmp' then we should exclude that directory from being monitored by tripwire for changes. To do that we can add following line under section with name rulename="Tripwire Data Files"
$(TWPOL)/temp -> (Temporary) (recurse=0) ;
Creating policy file
To create signed tripwire policy file from plain-text policy file, we can use:
twadmin --create-polfile --cfgfile /etc/tripwire/tw.cfg --polfile /etc/tripwire/tw.pol --site-keyfile /etc/tripwire/site.key /etc/tripwire/twpol.txt
Printing policy file
To print tripwire policy file we can use:
twadmin --print-polfile --cfgfile /etc/tripwire/tw.cfg --polfile /etc/tripwire/tw.pol --site-keyfile /etc/tripwire/site.key
- Refer to 'man twadmin' to learn how to encrypt files, decrypt files or check their encryption status. It can also be used to change passphrase of local and site key files.