Tripwire
改竄検知アプリケーションtripwireを扱っていきます。
準備
便利パッケージインストール
- perlはtripwireで利用
|
1 |
dnf -y install vim bash-completion perl |
epleリポジトリインストール
|
1 |
dnf -y install epel-release |
tripwireインストール
|
1 |
dnf --enablerepo=epel -y install tripwire |
初期設定
|
1 2 |
cd /etc/tripwire tripwire-setup-keyfiles |
- サイトキー
- サイト全体の設定ファイルやポリシーファイルの暗号化や署名に利用される
- /etc/tripwire/site.keyが生成される
- ローカルキー
- ローカルデータベースの更新、レポートファイルの保護に利用される
- /etc/tripwire/ホスト名-local.keyが生成される
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 |
---------------------------------------------- The Tripwire site and local passphrases are used to sign a variety of files, such as the configuration, policy, and database files. Passphrases should be at least 8 characters in length and contain both letters and numbers. See the Tripwire manual for more information. ---------------------------------------------- Creating key files... (When selecting a passphrase, keep in mind that good passphrases typically have upper and lower case letters, digits and punctuation marks, and are at least 8 characters in length.) Enter the site keyfile passphrase: password ← 入力 Verify the site keyfile passphrase: password ← 入力 Generating key (this may take several minutes)...Key generation complete. (When selecting a passphrase, keep in mind that good passphrases typically have upper and lower case letters, digits and punctuation marks, and are at least 8 characters in length.) Enter the local keyfile passphrase: password ← 入力 Verify the local keyfile passphrase: password ← 入力 Generating key (this may take several minutes)...Key generation complete. ---------------------------------------------- Signing configuration file... Please enter your site passphrase: password ← 入力 Wrote configuration file: /etc/tripwire/tw.cfg A clear-text version of the Tripwire configuration file: /etc/tripwire/twcfg.txt has been preserved for your inspection. It is recommended that you move this file to a secure location and/or encrypt it in place (using a tool such as GPG, for example) after you have examined it. ---------------------------------------------- Signing policy file... Please enter your site passphrase: password ← 入力 Wrote policy file: /etc/tripwire/tw.pol A clear-text version of the Tripwire policy file: /etc/tripwire/twpol.txt has been preserved for your inspection. This implements a minimal policy, intended only to test essential Tripwire functionality. You should edit the policy file to describe your system, and then use twadmin to generate a new signed copy of the Tripwire policy. Once you have a satisfactory Tripwire policy file, you should move the clear-text version to a secure location and/or encrypt it in place (using a tool such as GPG, for example). Now run "tripwire --init" to enter Database Initialization Mode. This reads the policy file, generates a database based on its contents, and then cryptographically signs the resulting database. Options can be entered on the command line to specify which policy, configuration, and key files are used to create the database. The filename for the database can be specified as well. If no options are specified, the default values from the current configuration file are used. [root@CENT84-server ~]# |
REPORTLEVELを4にしておく
- 報告レベル4が最大
|
1 |
vim /etc/tripwire/twcfg.txt |
ファイル内容
|
1 |
REPORTLEVEL =4 |
設定ファイルを生成
- tripwire-setup-keyfilesコマンドで生成したパスワードを入力
|
1 |
twadmin -m F -c tw.cfg -S site.key twcfg.txt |
ポリシー設定
デフォルトだと不要ディレクトリなどをスキャンしてしまうようなので、それらを除外するポリシー設定を投入する
|
1 |
vim /etc/tripwire/twpolmake.pl |
twpolmake.pl
参考：http://centossrv.com/tripwire.shtml
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 |
#!/usr/bin/perl # Tripwire Policy File customize tool # ---------------------------------------------------------------- # Copyright (C) 2003 Hiroaki Izumi # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; either version 2 # of the License, or (at your option) any later version. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. # ---------------------------------------------------------------- # Usage: # perl twpolmake.pl {Pol file} # ---------------------------------------------------------------- # $POLFILE=$ARGV[0]; open(POL,"$POLFILE") or die "open error: $POLFILE" ; my($myhost,$thost) ; my($sharp,$tpath,$cond) ; my($INRULE) = 0 ; while (<POL>) { chomp; if (($thost) = /^HOSTNAME\s*=\s*(.*)\s*;/) { $myhost = `hostname` ; chomp($myhost) ; if ($thost ne $myhost) { $_="HOSTNAME=\"$myhost\";" ; } } elsif ( /^{/ ) { $INRULE=1 ; } elsif ( /^}/ ) { $INRULE=0 ; } elsif ($INRULE == 1 and ($sharp,$tpath,$cond) = /^(\s*\#?\s*)(\/\S+)\b(\s+->\s+.+)$/) { $ret = ($sharp =~ s/\#//g) ; if ($tpath eq '/sbin/e2fsadm' ) { $cond =~ s/;\s+(tune2fs.*)$/; \#$1/ ; } if (! -s $tpath) { $_ = "$sharp#$tpath$cond" if ($ret == 0) ; } else { $_ = "$sharp$tpath$cond" ; } } print "$_\n" ; } close(POL) ; |
ポリシーの作成
|
1 |
perl twpolmake.pl twpol.txt > twpol.txt.new |
ポリシーから設定反映
|
1 |
twadmin -m P -c tw.cfg -p tw.pol -S site.key twpol.txt.new |
データベース作成（環境によっては2,3分かかる）
|
1 |
tripwire -m i -s -c tw.cfg |
動作確認
チェック実行
|
1 |
tripwire -m c -s -c /etc/tripwire/tw.cfg |
わざとファイル改ざんを発生させる
|
1 |
useradd test |
再度、チェック実行
|
1 |
tripwire -m c -s -c /etc/tripwire/tw.cfg |
チェックレポート出力ディレクトリ
|
1 |
ls -l /var/lib/tripwire/report |
チェックレポートを指定して、データベースを更新
|
1 |
tripwire -m u -a -s -c /etc/tripwire/tw.cfg -r /var/lib/tripwire/report/CENT84-server-20211102-032502.twr |
おまけ
レポート参照コマンド
|
1 2 3 4 5 |
# report-level 4 twprint --print-report --report-level 4 --twrfile /var/lib/tripwire/report/tripwire-20220102-161128.twr # report-level 0 twprint --print-report --report-level 0 --twrfile /var/lib/tripwire/report/tripwire-20220102-161128.twr |
特定ファイルの除外
|
1 2 |
twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt perl twpolmake.pl twpol.txt > twpol.txt.new |
- 「!/root/testfile ;」を追記する
|
1 |
vim /etc/tripwire/twpol.txt.new |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
# These files change the behavior of the root account ( rulename = "Root config files", severity = 100 ) { /root -> $(SEC_CRIT) ; # Catch all additions to /root /root/.Xresources -> $(SEC_CONFIG) ; /root/.bashrc -> $(SEC_CONFIG) ; /root/.bash_profile -> $(SEC_CONFIG) ; /root/.bash_logout -> $(SEC_CONFIG) ; /root/.cshrc -> $(SEC_CONFIG) ; /root/.tcshrc -> $(SEC_CONFIG) ; #/root/Mail -> $(SEC_CONFIG) ; #/root/mail -> $(SEC_CONFIG) ; #/root/.amandahosts -> $(SEC_CONFIG) ; #/root/.addressbook.lu -> $(SEC_CONFIG) ; #/root/.addressbook -> $(SEC_CONFIG) ; /root/.bash_history -> $(SEC_CONFIG) ; #/root/.elm -> $(SEC_CONFIG) ; /root/.esd_auth -> $(SEC_CONFIG) ; #/root/.gnome_private -> $(SEC_CONFIG) ; #/root/.gnome-desktop -> $(SEC_CONFIG) ; /root/.gnome -> $(SEC_CONFIG) ; /root/.ICEauthority -> $(SEC_CONFIG) ; #/root/.mc -> $(SEC_CONFIG) ; #/root/.pinerc -> $(SEC_CONFIG) ; #/root/.sawfish -> $(SEC_CONFIG) ; /root/.Xauthority -> $(SEC_CONFIG) -i ; # Changes Inode number on login #/root/.xauth -> $(SEC_CONFIG) ; #/root/.xsession-errors -> $(SEC_CONFIG) ; !/root/testfile ; } |
ポリシー更新
|
1 |
tripwire --update-policy -Z low /etc/tripwire/twpol.txt.new |
付録
動作している仮想マシンのovaファイルです。うまくいかない場合、こちらをインポートしていただき設定値をご確認いただければと思います！
https://vamdemic.sharepoint.com/:f:/s/vamdemicsystem/Ei2CjcKTrGRPvGfwMMxdFgwBWaJwvzxyR5bOM8AedHZb-A?e=SC9oS5
pass: dnsmasq