Learn how to – Install and Configure Tripwire on Ubuntu 22.04|20.04|18.04

Learn how to – Install and Configure Tripwire on Ubuntu 22.04|20.04|18.04.

In this blog post, we’ll look at the how to install and configure Tripwire on Ubuntu 22.04|20.04|18.04 Linux system. Tripwire is an open source host-based Intrusion Detection System. Tripwire can check for file integrity, and it will monitor and alert on file/directory change.

A Tripwire check compares the current filesystem state against a known baseline state and alerts on any changes it detects. The baseline and check behavior are controlled by a policy file, which specifies which files or directories to monitor, and which attributes to monitor on them, such as hashes, file permissions, and ownership.

When an expected change occurs, such as upgrading a package, the baseline database can be updated to the new known-good state. The policy can also be updated, for example, to reduce noise or cover a newly installed package.

Install Tripwire on Ubuntu 22.04|20.04|18.04

Tripwire package for Ubuntu is available from the apt repository. Install it by running:

sudo apt update
sudo apt install tripwire

This installation is an interactive process, it will ask you a couple of questions. Answer then accordingly to installTripwire on Ubuntu 22.04|20.04|18.04.

Create Tripwire keys and initialize the database.

Now that the installation has been successful, we need to generate keys and initialize database so that tripwire can start its work.

$ cd /etc/tripwire/
$ ls -l
total 36
-rw------- 1 root root  931 Nov 15 16:05 site.key
-rw-r--r-- 1 root root 4586 Nov 15 16:06 tw.cfg
-rw-r--r-- 1 root root 4159 Nov 15 16:06 tw.pol
-rw-r--r-- 1 root root  510 Nov 10 19:57 twcfg.txt
-rw-r--r-- 1 root root 6057 Nov 10 19:57 twpol.txt
-rw------- 1 root root  931 Nov 15 16:06 ubuntu22-local.key

We’ll modify twcfg.txt file REPORTLEVEL to 4 which is a maximum.

$ sudo vim twcfg.txt
ROOT          =/usr/sbin
POLFILE       =/etc/tripwire/tw.pol
DBFILE        =/var/lib/tripwire/$(HOSTNAME).twd
REPORTFILE    =/var/lib/tripwire/report/$(HOSTNAME)-$(DATE).twr
SITEKEYFILE   =/etc/tripwire/site.key
LOCALKEYFILE  =/etc/tripwire/$(HOSTNAME)-local.key
EDITOR        =/usr/bin/editor
LATEPROMPTING =false
LOOSEDIRECTORYCHECKING =false
MAILNOVIOLATIONS =true
EMAILREPORTLEVEL =3
REPORTLEVEL   =4
SYSLOGREPORTING =true
MAILMETHOD    =SMTP
SMTPHOST      =localhost
SMTPPORT      =25
TEMPDIRECTORY =/tmp

Generate a configuration file after the change:

$ sudo twadmin -m F -c tw.cfg -S site.key twcfg.txt
Please enter your site passphrase: <Enter-your-passphrase>
Wrote configuration file: /etc/tripwire/tw.cfg

Optimize Tripwire Policy file

Create a twpolmake.pl file with below content:

sudo vim twpolmake.pl

Add:

#!/usr/bin/perl

# Tripwire Policy File customize tool

# ----------------------------------------------------------------

# Copyright (C) 2003 Hiroaki Izumi

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.

# ----------------------------------------------------------------

# Usage:

#     perl twpolmake.pl {Pol file}

# ----------------------------------------------------------------

#

$POLFILE=$ARGV[0];

open(POL,"$POLFILE") or die "open error: $POLFILE" ;

my($myhost,$thost) ;

my($sharp,$tpath,$cond) ;

my($INRULE) = 0 ;
while (<POL>) {

    chomp;

    if (($thost) = /^HOSTNAMEs*=s*(.*)s*;/) {

        $myhost = `hostname` ; chomp($myhost) ;

        if ($thost ne $myhost) {

            $_="HOSTNAME="$myhost"";"" ;