Tripwire
改竄検知アプリケーションtripwireを扱っていきます。
準備
便利パッケージインストール
- perlはtripwireで利用
dnf -y install vim bash-completion perlepleリポジトリインストール
dnf -y install epel-releasetripwireインストール
dnf --enablerepo=epel -y install tripwire初期設定
cd /etc/tripwire
tripwire-setup-keyfiles- サイトキー
- サイト全体の設定ファイルやポリシーファイルの暗号化や署名に利用される
- /etc/tripwire/site.keyが生成される
- ローカルキー
- ローカルデータベースの更新、レポートファイルの保護に利用される
- /etc/tripwire/ホスト名-local.keyが生成される
----------------------------------------------
The Tripwire site and local passphrases are used to sign a variety of
files, such as the configuration, policy, and database files.
Passphrases should be at least 8 characters in length and contain both
letters and numbers.
See the Tripwire manual for more information.
----------------------------------------------
Creating key files...
(When selecting a passphrase, keep in mind that good passphrases typically
have upper and lower case letters, digits and punctuation marks, and are
at least 8 characters in length.)
Enter the site keyfile passphrase: password ← 入力
Verify the site keyfile passphrase: password ← 入力
Generating key (this may take several minutes)...Key generation complete.
(When selecting a passphrase, keep in mind that good passphrases typically
have upper and lower case letters, digits and punctuation marks, and are
at least 8 characters in length.)
Enter the local keyfile passphrase: password ← 入力
Verify the local keyfile passphrase: password ← 入力
Generating key (this may take several minutes)...Key generation complete.
----------------------------------------------
Signing configuration file...
Please enter your site passphrase: password ← 入力
Wrote configuration file: /etc/tripwire/tw.cfg
A clear-text version of the Tripwire configuration file:
/etc/tripwire/twcfg.txt
has been preserved for your inspection. It is recommended that you
move this file to a secure location and/or encrypt it in place (using a
tool such as GPG, for example) after you have examined it.
----------------------------------------------
Signing policy file...
Please enter your site passphrase: password ← 入力
Wrote policy file: /etc/tripwire/tw.pol
A clear-text version of the Tripwire policy file:
/etc/tripwire/twpol.txt
has been preserved for your inspection. This implements a minimal
policy, intended only to test essential Tripwire functionality. You
should edit the policy file to describe your system, and then use
twadmin to generate a new signed copy of the Tripwire policy.
Once you have a satisfactory Tripwire policy file, you should move the
clear-text version to a secure location and/or encrypt it in place
(using a tool such as GPG, for example).
Now run "tripwire --init" to enter Database Initialization Mode. This
reads the policy file, generates a database based on its contents, and
then cryptographically signs the resulting database. Options can be
entered on the command line to specify which policy, configuration, and
key files are used to create the database. The filename for the
database can be specified as well. If no options are specified, the
default values from the current configuration file are used.
[root@CENT84-server ~]#REPORTLEVELを4にしておく
- 報告レベル4が最大
vim /etc/tripwire/twcfg.txtファイル内容
REPORTLEVEL =4設定ファイルを生成
- tripwire-setup-keyfilesコマンドで生成したパスワードを入力
twadmin -m F -c tw.cfg -S site.key twcfg.txtポリシー設定
デフォルトだと不要ディレクトリなどをスキャンしてしまうようなので、それらを除外するポリシー設定を投入する
vim /etc/tripwire/twpolmake.pltwpolmake.pl
参考：http://centossrv.com/tripwire.shtml
#!/usr/bin/perl
# Tripwire Policy File customize tool
# ----------------------------------------------------------------
# Copyright (C) 2003 Hiroaki Izumi
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
# ----------------------------------------------------------------
# Usage:
# perl twpolmake.pl {Pol file}
# ----------------------------------------------------------------
#
$POLFILE=$ARGV[0];
open(POL,"$POLFILE") or die "open error: $POLFILE" ;
my($myhost,$thost) ;
my($sharp,$tpath,$cond) ;
my($INRULE) = 0 ;
while (<POL>) {
chomp;
if (($thost) = /^HOSTNAME\s*=\s*(.*)\s*;/) {
$myhost = `hostname` ; chomp($myhost) ;
if ($thost ne $myhost) {
$_="HOSTNAME=\"$myhost\";" ;
}
}
elsif ( /^{/ ) {
$INRULE=1 ;
}
elsif ( /^}/ ) {
$INRULE=0 ;
}
elsif ($INRULE == 1 and ($sharp,$tpath,$cond) = /^(\s*\#?\s*)(\/\S+)\b(\s+->\s+.+)$/) {
$ret = ($sharp =~ s/\#//g) ;
if ($tpath eq '/sbin/e2fsadm' ) {
$cond =~ s/;\s+(tune2fs.*)$/; \#$1/ ;
}
if (! -s $tpath) {
$_ = "$sharp#$tpath$cond" if ($ret == 0) ;
}
else {
$_ = "$sharp$tpath$cond" ;
}
}
print "$_\n" ;
}
close(POL) ;ポリシーの作成
perl twpolmake.pl twpol.txt > twpol.txt.newポリシーから設定反映
twadmin -m P -c tw.cfg -p tw.pol -S site.key twpol.txt.newデータベース作成（環境によっては2,3分かかる）
tripwire -m i -s -c tw.cfg動作確認
チェック実行
tripwire -m c -s -c /etc/tripwire/tw.cfgわざとファイル改ざんを発生させる
useradd test再度、チェック実行
tripwire -m c -s -c /etc/tripwire/tw.cfgチェックレポート出力ディレクトリ
ls -l /var/lib/tripwire/reportチェックレポートを指定して、データベースを更新
tripwire -m u -a -s -c /etc/tripwire/tw.cfg -r /var/lib/tripwire/report/CENT84-server-20211102-032502.twrおまけ
レポート参照コマンド
# report-level 4
twprint --print-report --report-level 4 --twrfile /var/lib/tripwire/report/tripwire-20220102-161128.twr
# report-level 0
twprint --print-report --report-level 0 --twrfile /var/lib/tripwire/report/tripwire-20220102-161128.twr特定ファイルの除外
twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt
perl twpolmake.pl twpol.txt > twpol.txt.new- 「!/root/testfile ;」を追記する
vim /etc/tripwire/twpol.txt.new# These files change the behavior of the root account
(
rulename = "Root config files",
severity = 100
)
{
/root -> $(SEC_CRIT) ; # Catch all additions to /root
/root/.Xresources -> $(SEC_CONFIG) ;
/root/.bashrc -> $(SEC_CONFIG) ;
/root/.bash_profile -> $(SEC_CONFIG) ;
/root/.bash_logout -> $(SEC_CONFIG) ;
/root/.cshrc -> $(SEC_CONFIG) ;
/root/.tcshrc -> $(SEC_CONFIG) ;
#/root/Mail -> $(SEC_CONFIG) ;
#/root/mail -> $(SEC_CONFIG) ;
#/root/.amandahosts -> $(SEC_CONFIG) ;
#/root/.addressbook.lu -> $(SEC_CONFIG) ;
#/root/.addressbook -> $(SEC_CONFIG) ;
/root/.bash_history -> $(SEC_CONFIG) ;
#/root/.elm -> $(SEC_CONFIG) ;
/root/.esd_auth -> $(SEC_CONFIG) ;
#/root/.gnome_private -> $(SEC_CONFIG) ;
#/root/.gnome-desktop -> $(SEC_CONFIG) ;
/root/.gnome -> $(SEC_CONFIG) ;
/root/.ICEauthority -> $(SEC_CONFIG) ;
#/root/.mc -> $(SEC_CONFIG) ;
#/root/.pinerc -> $(SEC_CONFIG) ;
#/root/.sawfish -> $(SEC_CONFIG) ;
/root/.Xauthority -> $(SEC_CONFIG) -i ; # Changes Inode number on login
#/root/.xauth -> $(SEC_CONFIG) ;
#/root/.xsession-errors -> $(SEC_CONFIG) ;
!/root/testfile ;
}ポリシー更新
tripwire --update-policy -Z low /etc/tripwire/twpol.txt.new付録
動作している仮想マシンのovaファイルです。うまくいかない場合、こちらをインポートしていただき設定値をご確認いただければと思います！
https://vamdemic.sharepoint.com/:f:/s/vamdemicsystem/Ei2CjcKTrGRPvGfwMMxdFgwBWaJwvzxyR5bOM8AedHZb-A?e=SC9oS5
pass: dnsmasq