Tripwire - Revision history

Ractive at 10:09, 28 October 2018

2018-10-28T10:09:22Z

← Older revision		Revision as of 10:09, 28 October 2018
Line 25:		Line 25:
	if the passwords arn't set up for whatever reason:		if the passwords arn't set up for whatever reason:
	sudo dpkg-reconfigure tripwire		sudo dpkg-reconfigure tripwire

			==Change Policies==

			to ignore certain files:
			!/srv/ro/myfile1.txt ;
			!/srv/ro/myfile2.txt ;


	==Normal Updates==		==Normal Updates==

2018-03-06T13:08:37Z

← Older revision		Revision as of 13:08, 6 March 2018
Line 41:		Line 41:
	Paste in the following line:		Paste in the following line:
	00 02 * * * sudo tripwire --check \| mail -s "Tripwire report for nsserver" someone@gmail.com		00 02 * * * sudo tripwire --check \| mail -s "Tripwire report for nsserver" someone@gmail.com

			==Email reports==
			Tripwire CAN email you on violations, BUT it requires either sendmail setup or SMTP listening on port 25.
			The following is a workaround in the case that you don't have a mailserver.


	==Reports and Logs==		==Reports and Logs==
	Tripwire reports are saved in /var/lib/tripwire/report/ and date stamped.		Tripwire reports are saved in /var/lib/tripwire/report/ and date stamped, but they are encrypted so don't bother trying to open them.
	sudo ls /var/lib/tripwire/report/		sudo ls /var/lib/tripwire/report/

2018-03-04T14:58:54Z

← Older revision		Revision as of 14:58, 4 March 2018
Line 26:		Line 26:
	sudo dpkg-reconfigure tripwire		sudo dpkg-reconfigure tripwire

	to update changes to your system the easy way:		==Normal Updates==
			To update changes to your system the easy way:
	sudo tripwire -m c -I		sudo tripwire -m c -I

	==cron.daily and crontab==		==cron.daily and crontab==
	I prefer to run things from crontab vs scripts in /etc/cron.daily		I prefer to run things from crontab vs scripts in /etc/cron.daily

2018-03-04T13:41:38Z

← Older revision		Revision as of 13:41, 4 March 2018
Line 34:		Line 34:
	sudo rm /etc/cron.daily/tripwire		sudo rm /etc/cron.daily/tripwire

	~~add~~ crontab entry to run a check and email the results to you (daily at 2am) NOTE: you need ssmtp set up to send the email.		Add crontab entry to run a check and email the results to you (daily at 2am) NOTE: you need ssmtp set up to send the email.
			sudo crontab -e

			Paste in the following line:
	00 02 * * * sudo tripwire --check \| mail -s "Tripwire report for nsserver" someone@gmail.com		00 02 * * * sudo tripwire --check \| mail -s "Tripwire report for nsserver" someone@gmail.com


	==Reports and Logs==		==Reports and Logs==

2018-03-04T13:40:35Z

@@ Line 28: / Line 28: @@
 to update changes to your system the easy way:
   sudo tripwire -m c -I
 ==Reports and Logs==

2018-03-04T13:35:01Z

← Older revision		Revision as of 13:35, 4 March 2018
Line 34:		Line 34:

	==References==		==References==
	https://www.howtoforge.com/tutorial/how-to-monitor-and-detect-modified-files-using-tripwire-on-ubuntu-1604/		https://www.howtoforge.com/tutorial/how-to-monitor-and-detect-modified-files-using-tripwire-on-ubuntu-1604<br>
			https://www.digitalocean.com/community/tutorials/how-to-use-tripwire-to-detect-server-intrusions-on-an-ubuntu-vps<br>
	https://www.digitalocean.com/community/tutorials/how-to-use-tripwire-to-detect-server-intrusions-on-an-ubuntu-vps		https://www.techrepublic.com/article/example-2-a-sample-tripwire-policy-file/<br>

2018-03-04T13:28:35Z

← Older revision		Revision as of 13:28, 4 March 2018
Line 29:		Line 29:
	sudo tripwire -m c -I		sudo tripwire -m c -I

	reports are saved in:		==Reports and Logs==
	ls /var/lib/tripwire/report/		Tripwire reports are saved in /var/lib/tripwire/report/ and date stamped.
			sudo ls /var/lib/tripwire/report/

	==References==		==References==

2018-03-04T13:06:08Z

← Older revision		Revision as of 13:06, 4 March 2018
Line 1:		Line 1:


			==Install==

			You will set pass phrases ect during the package install.
	sudo apt install tripwire		sudo apt install tripwire

	~~setpassphrases ect during~~ install		After install you have to initialize the database.

	sudo tripwire --init		sudo tripwire --init

			Then run a check, you will find some errors, fixing some of these requires editing the policy file.
	sudo tripwire --check		sudo tripwire --check

2018-03-04T13:00:40Z

← Older revision		Revision as of 13:00, 4 March 2018
Line 24:		Line 24:
	to update changes to your system the easy way:		to update changes to your system the easy way:
	sudo tripwire -m c -I		sudo tripwire -m c -I

			reports are saved in:
			ls /var/lib/tripwire/report/

	==References==		==References==

2018-03-03T23:38:09Z

← Older revision		Revision as of 23:38, 3 March 2018
Line 15:		Line 15:

	sudo tripwire --check		sudo tripwire --check

			after editing the configuration file:
			sudo twadmin --create-cfgfile -S /etc/tripwire/site.key /etc/tripwire/twcfg.txt

	if the passwords arn't set up for whatever reason:		if the passwords arn't set up for whatever reason: