Tripwire

Install

You will set pass phrases ect during the package install.

sudo apt install tripwire

After install you have to initialize the database.

sudo tripwire --init

Then run a check, you will find some errors, fixing some of these requires editing the policy file.

sudo tripwire --check

after editing the policy file do this:

sudo twadmin -m P /etc/tripwire/twpol.txt

sudo tripwire --init

sudo tripwire --check

after editing the configuration file:

sudo twadmin --create-cfgfile -S /etc/tripwire/site.key /etc/tripwire/twcfg.txt

if the passwords arn't set up for whatever reason:

sudo dpkg-reconfigure tripwire

to update changes to your system the easy way:

sudo tripwire -m c -I

Tripwire reports are saved in /var/lib/tripwire/report/ and date stamped.

sudo ls /var/lib/tripwire/report/