HCoop Git - hcoop/zz_old/ikiwiki/blob - TripWire.mdwn

   1 #format wiki
   2 #language en
   3
   4 Tripwire is a tool that keeps a database of information about files on the server.  It performs regular checks and reports about files that have been changed, deleted, created, or renamed.
   5
   6 == Automatic Check ==
   7 Cron runs `/etc/cron.daily/tripwire` once a day.  This invokes tripwire as `/usr/sbin/tripwire --check --quiet`.  The meaning of the parameters:
   8  * `--check` causes the program to compare the current files in the system with the recorded attributes in the database, save a signed binary report file, and print a text report to stdout (which is mailed by cron)
   9  * `--quiet` tells it not to print a lot of stuff while it is working
  10
  11 == Configuration Files `/etc/tripwire` ==
  12  * `fyodor.hcoop.net-local.key` is a cryptographic key used to sign the database and reports
  13  * `site.key` is a cryptographic key used to sign the configuration and policy files
  14  * `tw.cfg` is a signed binary file that holds configuration information
  15  * `twcfg.txt` is the text source of tw.cfg
  16  * `tw.pol` is a signed binary file that holds the logging and reporting policy information
  17  * `twpol.txt` is the text source of tw.pol
  18
  19 == Data Files `/var/lib/tripwire` ==
  20  * `fyodor.hcoop.net.twd` is the signed tripwire database, storing information about every monitored file
  21  * `reports/` holds the signed binary reports
  22
  23 == Updating the Database ==
  24 The check operation creates a signed binary report file every time it runs.  This report is like a "diff" of the database and the current file system.  The database is updated by "patching" it with the report.  Here is the procedure:
  25
  26  1. The command is `tripwire --update`
  27  1. If it complains that the file could not be opened then you must specify the report file with the `-r` option.  Choose the file with the most recent timestamp.  The timestamp is included in the filename so use tab-completion.  Example: `tripwire --update -r /var/lib/tripwire/report/fyodor.hcoop.net-20051023-065438.twr`
  28  1. This will open a selection file in the `pico` editor.  Look through the file and clear the `[x]` for any line that should not be saved to the database.  The process is essentially certifying that each filesystem change is valid and proper.
  29  1. Save the file with ^O (Control-Oh)
  30  1. Quit with ^X (Control-x)
  31  1. Now you will be prompted for the local passphrase.
  32
  33 == Changing the Policy ==
  34  1. First follow the instructions to Update the Database
  35  1. change to `/etc/tripwire`
  36  1. edit the policy in `twpol.txt`
  37  1. create the signed binary tw.pol file with `tripwire --update-policy --secure-mode low twpol.txt`
  38  1. you will be prompted for the site and local passphrases
  39
  40 == Updating the Configuration ==
  41  1. change to `/etc/tripwire`
  42  1. edit the configuration in `twcfg.txt`
  43  1. run `twadmin --create-cfgfile -S site.key -c tw.cfg twcfg.txt` to create the signed binary tw.cfg file
  44  1. you will be prompted for the site passphrase
  45
  46 == Passphrases ==
  47 MichaelLeonhard generated the passphrases.  To obtain them, save your public key to /root/$(USER).pubkey.  Then send Michael an email about it.  He will encrypt the passphrases and email them to you.  The security of Tripwire depends on these passphrases.  DO NOT store your private key or decrypt the passphrases on Fyodor.  Here is the procedure:
  48  1. Download the latest version of [http://www.gnupg.org/ GnuPG] to your personal computer
  49  1. Check the signature of the downloaded file
  50  1. Install GnuPG onto your personal computer
  51  1. On your personal computer, create a public/private key pair with `gpg --gen-key`, use a good passphrase
  52  1. Export an ASCII version of your public key with `gpg --export -a >> public.key`
  53  1. Copy your public key to your home directory on Fyodor with `scp public.key username@fyodor.hcoop.net:`
  54  1. SSH into Fyodor and demonstrate your administrative priveleges by copying the public key to a secure location, `cp ~/public.key /root/username.pubkey` (where username is your username)
  55  1. Email MichaelLeonhard (username leonhard) to request a copy of the passphrases
  56  1. Decrypt the passphrase:
  57    * Read Michael's email on your personal computer, copy the PGP MESSAGE section to the clipboard
  58    * Open a terminal (or cmd prompt) on your personal computer and run `gpg` on your personal computer
  59    * Paste the GPG message block into the terminal
  60    * Type your secret passphrase, hit enter, then type ^Z (CTRL-Z)
  61    * Write down the passphrases that are printed out
  62    * Close the terminal
  63
  64 Please note how "your personal computer" appears throughout these instructions.  Your private key and the decrypted passphrases should only exist on your personal computer.  Thanks for caring about security.
  65
  66 --MichaelLeonhard
  67
  68 ----
  69 CategorySystemAdministration