1. 2004, Jei Tripwire An Intrusion Detection Tool Information Networking Security and Assurance Lab National Chung Cheng University

2. Outline What, How and The Goal Overview Example Conclusion Information Networking Security and Assurance Lab National Chung Cheng University

3. Outline What, How and The Goal Overview Example Conclusion Information Networking Security and Assurance Lab National Chung Cheng University

4. Description Tripwire software is a tool that checks to see what has changed on your system Tripwire creates a database of advanced mathematical checksums to take a snapshot of a system’s file properties and contents The tripwire monitors key attributes of files that should not change, including binary signature, size, expected change of size, etc

5. Web Site Open source  http://www.tripwire.org http://www.tripwire.org Commercial version  http://www.tripwire.com http://www.tripwire.com Latest version  http://sourceforge.net/projects/tripwire/ http://sourceforge.net/projects/tripwire/ Information Networking Security and Assurance Lab National Chung Cheng University

6. Outline What, How and The Goal Overview Example Conclusion Information Networking Security and Assurance Lab National Chung Cheng University

7. Three passwords you must set site keyfile passphrase local keyfile passphrase your site passphrase Information Networking Security and Assurance Lab National Chung Cheng University

8. The files you must know $HOSTNAME-local.key  Database and report files Site-key  Configuration and policy files tw.cfg  Binary file twcfg.txt  Clear text tw.pol  Binary file twpol.txt  Clear text

9. The command tripwire twadmin twprint siggen Information Networking Security and Assurance Lab National Chung Cheng University

10. The mode of tripwire Database initialization mode  #tripwire –m i [options] Integrity checking mode  #tripwire –m c [options] [object1 [object2…]] Database update mode  #tripwire –m u [options] Policy update mode  #tripwire –m p [options] policyfile.txt Test mode  #tripwire –m t [options]

11. The operation of twadmin Creating a configuration file  #twadmin –m F [options] cfg.txt Printing a configuration file  #twadmin –m f [options] Replacing a policy file  #twadmin –m P [options] policyfile.txt Printing a policy file  #twadmin –m p [options] Removing encryption from a file  #twadmin –m r [options] file1 [file2…] Encrypting a file  #twadmin –m E [options] file1 [file2…] Examine encryption of a file  #twadmin –m e [options] file1 [file2…] Generate a key  #twadmin –m G [options]

12. The mode of twprint Report printing mode  #twprint –m r [options] Database printing mode  #twprint –m d [options] Information Networking Security and Assurance Lab National Chung Cheng University

13. The operation of siggen A utility displays the hash function values for the specified files  #siggen [options] file1 [file2…] Information Networking Security and Assurance Lab National Chung Cheng University

14. Outline What, How and The Goal Overview Example Conclusion Information Networking Security and Assurance Lab National Chung Cheng University

15. Installation OS  Debian GNU/Linux The test directory  /root/test_attack exe.cpp, ifs.inc, quota, sc-bw.zip Get the package of tripwire  http://www.tripwire.org/downloads/index.php http://www.tripwire.org/downloads/index.php Untar and unzip the package Go to the tripwire directory

16. Installation Execute the script of installation License agreement The operation that tripwire will do

17. Installation Enter the site keyfile passphrase Enter the local keyfile passphrase Enter your site passphrase

18. Installation Succeed

19. Create a policy file testpolicy.txt The directory you want to check Indicate the configuration file The policy file you want to create Indicate the site keyflie The clear-text file

20. Check the policy file The crypted policy file No mistake… Information Networking Security and Assurance Lab National Chung Cheng University

21. Initial the database You must indicate the policy file The database file

22. Check your database file Indicate the database file The files are included in the /root/test_attack

23. Check your system The command You must care Information Networking Security and Assurance Lab National Chung Cheng University

24. Modify your system Operation  Modify the exe.cpp  Add the file “ceo” to /root/test_attack The operation you do

25. Update your database Indicate the latest report file Be sure the modification Information Networking Security and Assurance Lab National Chung Cheng University

26. The crontab Using “crontab” to run Tripwire check every day as 0:00 and the output will be mailed to m9335@cn.ee.ccu.edu.tw Information Networking Security and Assurance Lab National Chung Cheng University

27. /etc/tripwire/tw.cfg /etc/tripwire/tw.pol Information Networking Security and Assurance Lab National Chung Cheng University

28. Outline What, How and The Goal Overview Example Conclusion Information Networking Security and Assurance Lab National Chung Cheng University

29. Secure In-Depth Information Networking Security and Assurance Lab National Chung Cheng University

30. Reference http://www.linuxforum.com/ http://www.tslg.idv.tw/modules/freecontent/ index.php?id=12 http://www.tslg.idv.tw/modules/freecontent/ index.php?id=12 Information Networking Security and Assurance Lab National Chung Cheng University