Tripwire
改竄検知アプリケーションtripwireを扱っていきます。
準備
便利パッケージインストール
- perlはtripwireで利用
dnf -y install vim bash-completion perl
epleリポジトリインストール
dnf -y install epel-release
tripwireインストール
dnf --enablerepo=epel -y install tripwire
初期設定
cd /etc/tripwire
tripwire-setup-keyfiles
- サイトキー
- サイト全体の設定ファイルやポリシーファイルの暗号化や署名に利用される
- /etc/tripwire/site.keyが生成される
- ローカルキー
- ローカルデータベースの更新、レポートファイルの保護に利用される
- /etc/tripwire/ホスト名-local.keyが生成される
----------------------------------------------
The Tripwire site and local passphrases are used to sign a variety of
files, such as the configuration, policy, and database files.
Passphrases should be at least 8 characters in length and contain both
letters and numbers.
See the Tripwire manual for more information.
----------------------------------------------
Creating key files...
(When selecting a passphrase, keep in mind that good passphrases typically
have upper and lower case letters, digits and punctuation marks, and are
at least 8 characters in length.)
Enter the site keyfile passphrase: password ← 入力
Verify the site keyfile passphrase: password ← 入力
Generating key (this may take several minutes)...Key generation complete.
(When selecting a passphrase, keep in mind that good passphrases typically
have upper and lower case letters, digits and punctuation marks, and are
at least 8 characters in length.)
Enter the local keyfile passphrase: password ← 入力
Verify the local keyfile passphrase: password ← 入力
Generating key (this may take several minutes)...Key generation complete.
----------------------------------------------
Signing configuration file...
Please enter your site passphrase: password ← 入力
Wrote configuration file: /etc/tripwire/tw.cfg
A clear-text version of the Tripwire configuration file:
/etc/tripwire/twcfg.txt
has been preserved for your inspection. It is recommended that you
move this file to a secure location and/or encrypt it in place (using a
tool such as GPG, for example) after you have examined it.
----------------------------------------------
Signing policy file...
Please enter your site passphrase: password ← 入力
Wrote policy file: /etc/tripwire/tw.pol
A clear-text version of the Tripwire policy file:
/etc/tripwire/twpol.txt
has been preserved for your inspection. This implements a minimal
policy, intended only to test essential Tripwire functionality. You
should edit the policy file to describe your system, and then use
twadmin to generate a new signed copy of the Tripwire policy.
Once you have a satisfactory Tripwire policy file, you should move the
clear-text version to a secure location and/or encrypt it in place
(using a tool such as GPG, for example).
Now run "tripwire --init" to enter Database Initialization Mode. This
reads the policy file, generates a database based on its contents, and
then cryptographically signs the resulting database. Options can be
entered on the command line to specify which policy, configuration, and
key files are used to create the database. The filename for the
database can be specified as well. If no options are specified, the
default values from the current configuration file are used.
[root@CENT84-server ~]#
REPORTLEVELを4にしておく
- 報告レベル4が最大
vim /etc/tripwire/twcfg.txt
ファイル内容
REPORTLEVEL =4
設定ファイルを生成
- tripwire-setup-keyfilesコマンドで生成したパスワードを入力
twadmin -m F -c tw.cfg -S site.key twcfg.txt
ポリシー設定
デフォルトだと不要ディレクトリなどをスキャンしてしまうようなので、それらを除外するポリシー設定を投入する
vim /etc/tripwire/twpolmake.pl
twpolmake.pl
参考:http://centossrv.com/tripwire.shtml
#!/usr/bin/perl
# Tripwire Policy File customize tool
# ----------------------------------------------------------------
# Copyright (C) 2003 Hiroaki Izumi
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
# ----------------------------------------------------------------
# Usage:
# perl twpolmake.pl {Pol file}
# ----------------------------------------------------------------
#
$POLFILE=$ARGV[0];
open(POL,"$POLFILE") or die "open error: $POLFILE" ;
my($myhost,$thost) ;
my($sharp,$tpath,$cond) ;
my($INRULE) = 0 ;
while (<POL>) {
chomp;
if (($thost) = /^HOSTNAME\s*=\s*(.*)\s*;/) {
$myhost = `hostname` ; chomp($myhost) ;
if ($thost ne $myhost) {
$_="HOSTNAME=\"$myhost\";" ;
}
}
elsif ( /^{/ ) {
$INRULE=1 ;
}
elsif ( /^}/ ) {
$INRULE=0 ;
}
elsif ($INRULE == 1 and ($sharp,$tpath,$cond) = /^(\s*\#?\s*)(\/\S+)\b(\s+->\s+.+)$/) {
$ret = ($sharp =~ s/\#//g) ;
if ($tpath eq '/sbin/e2fsadm' ) {
$cond =~ s/;\s+(tune2fs.*)$/; \#$1/ ;
}
if (! -s $tpath) {
$_ = "$sharp#$tpath$cond" if ($ret == 0) ;
}
else {
$_ = "$sharp$tpath$cond" ;
}
}
print "$_\n" ;
}
close(POL) ;
ポリシーの作成
perl twpolmake.pl twpol.txt > twpol.txt.new
ポリシーから設定反映
twadmin -m P -c tw.cfg -p tw.pol -S site.key twpol.txt.new
データベース作成(環境によっては2,3分かかる)
tripwire -m i -s -c tw.cfg
動作確認
チェック実行
tripwire -m c -s -c /etc/tripwire/tw.cfg
わざとファイル改ざんを発生させる
useradd test
再度、チェック実行
tripwire -m c -s -c /etc/tripwire/tw.cfg
チェックレポート出力ディレクトリ
ls -l /var/lib/tripwire/report
チェックレポートを指定して、データベースを更新
tripwire -m u -a -s -c /etc/tripwire/tw.cfg -r /var/lib/tripwire/report/CENT84-server-20211102-032502.twr
おまけ
レポート参照コマンド
# report-level 4
twprint --print-report --report-level 4 --twrfile /var/lib/tripwire/report/tripwire-20220102-161128.twr
# report-level 0
twprint --print-report --report-level 0 --twrfile /var/lib/tripwire/report/tripwire-20220102-161128.twr
特定ファイルの除外
twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt
perl twpolmake.pl twpol.txt > twpol.txt.new
- 「!/root/testfile ;」を追記する
vim /etc/tripwire/twpol.txt.new
# These files change the behavior of the root account
(
rulename = "Root config files",
severity = 100
)
{
/root -> $(SEC_CRIT) ; # Catch all additions to /root
/root/.Xresources -> $(SEC_CONFIG) ;
/root/.bashrc -> $(SEC_CONFIG) ;
/root/.bash_profile -> $(SEC_CONFIG) ;
/root/.bash_logout -> $(SEC_CONFIG) ;
/root/.cshrc -> $(SEC_CONFIG) ;
/root/.tcshrc -> $(SEC_CONFIG) ;
#/root/Mail -> $(SEC_CONFIG) ;
#/root/mail -> $(SEC_CONFIG) ;
#/root/.amandahosts -> $(SEC_CONFIG) ;
#/root/.addressbook.lu -> $(SEC_CONFIG) ;
#/root/.addressbook -> $(SEC_CONFIG) ;
/root/.bash_history -> $(SEC_CONFIG) ;
#/root/.elm -> $(SEC_CONFIG) ;
/root/.esd_auth -> $(SEC_CONFIG) ;
#/root/.gnome_private -> $(SEC_CONFIG) ;
#/root/.gnome-desktop -> $(SEC_CONFIG) ;
/root/.gnome -> $(SEC_CONFIG) ;
/root/.ICEauthority -> $(SEC_CONFIG) ;
#/root/.mc -> $(SEC_CONFIG) ;
#/root/.pinerc -> $(SEC_CONFIG) ;
#/root/.sawfish -> $(SEC_CONFIG) ;
/root/.Xauthority -> $(SEC_CONFIG) -i ; # Changes Inode number on login
#/root/.xauth -> $(SEC_CONFIG) ;
#/root/.xsession-errors -> $(SEC_CONFIG) ;
!/root/testfile ;
}
ポリシー更新
tripwire --update-policy -Z low /etc/tripwire/twpol.txt.new
付録
動作している仮想マシンのovaファイルです。うまくいかない場合、こちらをインポートしていただき設定値をご確認いただければと思います!
https://vamdemic.sharepoint.com/:f:/s/vamdemicsystem/Ei2CjcKTrGRPvGfwMMxdFgwBWaJwvzxyR5bOM8AedHZb-A?e=SC9oS5
pass: dnsmasq