Tripwire

改竄検知アプリケーションtripwireを扱っていきます。

準備

便利パッケージインストール

  • perlはtripwireで利用
dnf -y install vim bash-completion perl

epleリポジトリインストール

dnf -y install epel-release

tripwireインストール

dnf --enablerepo=epel -y install tripwire

初期設定

cd /etc/tripwire
tripwire-setup-keyfiles
  • サイトキー
    • サイト全体の設定ファイルやポリシーファイルの暗号化や署名に利用される
    • /etc/tripwire/site.keyが生成される
  • ローカルキー
    • ローカルデータベースの更新、レポートファイルの保護に利用される
    • /etc/tripwire/ホスト名-local.keyが生成される
----------------------------------------------
The Tripwire site and local passphrases are used to sign a  variety  of
files, such as the configuration, policy, and database files.

Passphrases should be at least 8 characters in length and contain  both
letters and numbers.

See the Tripwire manual for more information.

----------------------------------------------
Creating key files...

(When selecting a passphrase, keep in mind that good passphrases typically
have upper and lower case letters, digits and punctuation marks, and are
at least 8 characters in length.)

Enter the site keyfile passphrase: password ← 入力
Verify the site keyfile passphrase: password ← 入力
Generating key (this may take several minutes)...Key generation complete.

(When selecting a passphrase, keep in mind that good passphrases typically
have upper and lower case letters, digits and punctuation marks, and are
at least 8 characters in length.)

Enter the local keyfile passphrase: password ← 入力
Verify the local keyfile passphrase: password ← 入力
Generating key (this may take several minutes)...Key generation complete.

----------------------------------------------
Signing configuration file...
Please enter your site passphrase: password ← 入力
Wrote configuration file: /etc/tripwire/tw.cfg

A clear-text version of the Tripwire configuration file:
/etc/tripwire/twcfg.txt
has been preserved for your inspection.  It  is  recommended  that  you
move this file to a secure location and/or encrypt it in place (using a
tool such as GPG, for example) after you have examined it.

----------------------------------------------
Signing policy file...
Please enter your site passphrase: password ← 入力
Wrote policy file: /etc/tripwire/tw.pol

A clear-text version of the Tripwire policy file:
/etc/tripwire/twpol.txt
has been preserved for  your  inspection.  This  implements  a  minimal
policy, intended only to test  essential  Tripwire  functionality.  You
should edit the policy file to  describe  your  system,  and  then  use
twadmin to generate a new signed copy of the Tripwire policy.

Once you have a satisfactory Tripwire policy file, you should move  the
clear-text version to a secure location  and/or  encrypt  it  in  place
(using a tool such as GPG, for example).

Now run "tripwire --init" to enter Database Initialization  Mode.  This
reads the policy file, generates a database based on its contents,  and
then cryptographically signs the resulting  database.  Options  can  be
entered on the command line to specify which policy, configuration, and
key files are used  to  create  the  database.  The  filename  for  the
database can be specified as well. If no  options  are  specified,  the
default values from the current configuration file are used.

[root@CENT84-server ~]#

REPORTLEVELを4にしておく

  • 報告レベル4が最大
vim /etc/tripwire/twcfg.txt

ファイル内容

REPORTLEVEL            =4

設定ファイルを生成

  • tripwire-setup-keyfilesコマンドで生成したパスワードを入力
twadmin -m F -c tw.cfg -S site.key twcfg.txt

ポリシー設定

デフォルトだと不要ディレクトリなどをスキャンしてしまうようなので、それらを除外するポリシー設定を投入する

vim /etc/tripwire/twpolmake.pl

twpolmake.pl

参考:http://centossrv.com/tripwire.shtml

#!/usr/bin/perl
# Tripwire Policy File customize tool
# ----------------------------------------------------------------
# Copyright (C) 2003 Hiroaki Izumi
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
# ----------------------------------------------------------------
# Usage:
#     perl twpolmake.pl {Pol file}
# ----------------------------------------------------------------
#
$POLFILE=$ARGV[0];

open(POL,"$POLFILE") or die "open error: $POLFILE" ;
my($myhost,$thost) ;
my($sharp,$tpath,$cond) ;
my($INRULE) = 0 ;

while (<POL>) {
    chomp;
    if (($thost) = /^HOSTNAME\s*=\s*(.*)\s*;/) {
        $myhost = `hostname` ; chomp($myhost) ;
        if ($thost ne $myhost) {
            $_="HOSTNAME=\"$myhost\";" ;
        }
    }
    elsif ( /^{/ ) {
        $INRULE=1 ;
    }
    elsif ( /^}/ ) {
        $INRULE=0 ;
    }
    elsif ($INRULE == 1 and ($sharp,$tpath,$cond) = /^(\s*\#?\s*)(\/\S+)\b(\s+->\s+.+)$/) {
        $ret = ($sharp =~ s/\#//g) ;
        if ($tpath eq '/sbin/e2fsadm' ) {
            $cond =~ s/;\s+(tune2fs.*)$/; \#$1/ ;
        }
        if (! -s $tpath) {
            $_ = "$sharp#$tpath$cond" if ($ret == 0) ;
        }
        else {
            $_ = "$sharp$tpath$cond" ;
        }
    }
    print "$_\n" ;
}
close(POL) ;

ポリシーの作成

perl twpolmake.pl twpol.txt > twpol.txt.new

ポリシーから設定反映

twadmin -m P -c tw.cfg -p tw.pol -S site.key twpol.txt.new

データベース作成(環境によっては2,3分かかる)

tripwire -m i -s -c tw.cfg

動作確認

チェック実行

tripwire -m c -s -c /etc/tripwire/tw.cfg

わざとファイル改ざんを発生させる

useradd test

再度、チェック実行

tripwire -m c -s -c /etc/tripwire/tw.cfg

チェックレポート出力ディレクトリ

ls -l /var/lib/tripwire/report

チェックレポートを指定して、データベースを更新

tripwire -m u -a -s -c /etc/tripwire/tw.cfg -r /var/lib/tripwire/report/CENT84-server-20211102-032502.twr

おまけ

レポート参照コマンド

# report-level 4
twprint  --print-report --report-level 4 --twrfile /var/lib/tripwire/report/tripwire-20220102-161128.twr

# report-level 0
twprint  --print-report --report-level 0 --twrfile /var/lib/tripwire/report/tripwire-20220102-161128.twr

特定ファイルの除外

twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt
perl twpolmake.pl twpol.txt > twpol.txt.new
  • 「!/root/testfile ;」を追記する
vim /etc/tripwire/twpol.txt.new
# These files change the behavior of the root account
(
  rulename = "Root config files",
  severity = 100
)
{
     /root                             -> $(SEC_CRIT) ; # Catch all additions to /root
     /root/.Xresources                 -> $(SEC_CONFIG) ;
     /root/.bashrc                     -> $(SEC_CONFIG) ;
     /root/.bash_profile               -> $(SEC_CONFIG) ;
     /root/.bash_logout                -> $(SEC_CONFIG) ;
     /root/.cshrc                      -> $(SEC_CONFIG) ;
     /root/.tcshrc                     -> $(SEC_CONFIG) ;
    #/root/Mail                        -> $(SEC_CONFIG) ;
    #/root/mail                        -> $(SEC_CONFIG) ;
    #/root/.amandahosts                -> $(SEC_CONFIG) ;
    #/root/.addressbook.lu             -> $(SEC_CONFIG) ;
    #/root/.addressbook                -> $(SEC_CONFIG) ;
     /root/.bash_history               -> $(SEC_CONFIG) ;
    #/root/.elm                        -> $(SEC_CONFIG) ;
     /root/.esd_auth                   -> $(SEC_CONFIG) ;
    #/root/.gnome_private              -> $(SEC_CONFIG) ;
    #/root/.gnome-desktop              -> $(SEC_CONFIG) ;
     /root/.gnome                      -> $(SEC_CONFIG) ;
     /root/.ICEauthority               -> $(SEC_CONFIG) ;
    #/root/.mc                         -> $(SEC_CONFIG) ;
    #/root/.pinerc                     -> $(SEC_CONFIG) ;
    #/root/.sawfish                    -> $(SEC_CONFIG) ;
     /root/.Xauthority                 -> $(SEC_CONFIG) -i ; # Changes Inode number on login
    #/root/.xauth                      -> $(SEC_CONFIG) ;
    #/root/.xsession-errors            -> $(SEC_CONFIG) ;
    !/root/testfile ;
}

ポリシー更新

tripwire --update-policy -Z low /etc/tripwire/twpol.txt.new

付録

動作している仮想マシンのovaファイルです。うまくいかない場合、こちらをインポートしていただき設定値をご確認いただければと思います!

https://vamdemic.sharepoint.com/:f:/s/vamdemicsystem/Ei2CjcKTrGRPvGfwMMxdFgwBWaJwvzxyR5bOM8AedHZb-A?e=SC9oS5
pass: dnsmasq

参考サイト

https://www.server-world.info/query?os=CentOS_8&p=tripwire