hoge# cd /usr/ports/security/tripwire hoge# make hoge# . hoge# . hoge# . hoge# make install hoge# . hoge# . hoge# . hoge# Continue with installation? [y/n] y hoge# Press ENTER to view the License Agreement.（改行してドキュメントの読み終える） hoge# Please type "accept" to indicate your acceptance of this hoge# license agreement. [do not accept] accept hoge# . hoge# . hoge# . hoge# Enter the site keyfile passphrase:（サイト用パスワードを入力） hoge# Verify the site keyfile passphrase:（ここでサイト用パスワードを再入力） hoge# . hoge# . hoge# . hoge# Enter the local keyfile passphrase:（ここでローカル用パスワードを入力） hoge# Verify the local keyfile passphrase:（ローカル用パスワードを再入力） hoge# . hoge# . hoge# 途中何回かサイトのパスワードを聞いてくるので、入力・・・ hoge# . |
hoge# Parsing policy file: /etc/tripwire/tw.pol hoge# Generating the database... hoge# *** Processing Unix File System *** hoge# Warning: File system error. hoge# Filename: /usr/local/krb5 hoge# no such or directory hoge# Continuing... hoge# Warning: File system error. hoge# Filename: /usr/local/krb5/man hoge# no such or directory hoge# Continuing... hoge# Warning: File system error. hoge# Filename: /usr/local/krb5/man1 hoge# no such or directory hoge# Continuing... hoge# Warning: File system error. hoge# Filename: /usr/local/krb5/man2 hoge# no such or directory hohe# Continuing... |
hoge# cd /usr/local/etc/tripwire hoge# cp twpol.txt twpol.txt.bak hoge# ee twpol.txt |
#このファイルはありませんね・・・。 #/.login # krb5関係はインストールしていないので・・・。 # /usr/local/krb5 -> $(SEC_CRIT) (recurse = true) ; # /usr/local/krb5/man -> $(SEC_CONFIG) ; # !/usr/local/krb5/man/whatis ; # !/usr/local/krb5/man/.glimpse_filenames ; # !/usr/local/krb5/man/.glimpse_filenames_index ; # !/usr/local/krb5/man/.glimpse_filetimes ; # !/usr/local/krb5/man/.glimpse_filters ; # !/usr/local/krb5/man/.glimpse_index ; # !/usr/local/krb5/man/.glimpse_messages ; # !/usr/local/krb5/man/.glimpse_partitions ; # !/usr/local/krb5/man/.glimpse_statistics ; # !/usr/local/krb5/man/.glimpse_turbo ; # /usr/local/krb5/man/man1 -> $(SEC_CRIT) (recurse = true) ; # /usr/local/krb5/man/man2 -> $(SEC_CRIT) (recurse = true) ; # /usr/local/krb5/man/man3 -> $(SEC_CRIT) (recurse = true) ; # /usr/local/krb5/man/man4 -> $(SEC_CRIT) (recurse = true) ; # /usr/local/krb5/man/man5 -> $(SEC_CRIT) (recurse = true) ; # /usr/local/krb5/man/man6 -> $(SEC_CRIT) (recurse = true) ; # /usr/local/krb5/man/man7 -> $(SEC_CRIT) (recurse = true) ; # /usr/local/krb5/man/man8 -> $(SEC_CRIT) (recurse = true) ; # /usr/local/krb5/man/man9 -> $(SEC_CRIT) (recurse = true) ; # /usr/local/krb5/man/manl -> $(SEC_CRIT) (recurse = true) ; # /usr/local/krb5/man/mann -> $(SEC_CRIT) (recurse = true) ; # ! /usr/local/krb5/man/cat1 ; # ! /usr/local/krb5/man/cat2 ; # ! /usr/local/krb5/man/cat3 ; # ! /usr/local/krb5/man/cat4 ; # ! /usr/local/krb5/man/cat5 ; # ! /usr/local/krb5/man/cat6 ; # ! /usr/local/krb5/man/cat7 ; # ! /usr/local/krb5/man/cat8 ; # ! /usr/local/krb5/man/cat9 ; # ! /usr/local/krb5/man/catl ; # ! /usr/local/krb5/man/catn ; # X-Window関係もインストールしていないので・・・。 # /usr/X11R6/lib/X11/xdm -> $(SEC_CONFIG) (recurse = true) ; # !/usr/X11R6/lib/X11/xdm/xdm-errors ; # !/usr/X11R6/lib/X11/xdm/authdir/authfiles ; # !/usr/X11R6/lib/X11/xdm/xdm-pid ; # /usr/X11R6/lib/X11/xkb/compiled -> $(SEC_CONFIG) (recurse = true) ; # /usr/X11R6/man -> $(SEC_CONFIG) ; # !/usr/X11R6/man/whatis ; # !/usr/X11R6/man/.glimpse_filenames ; # !/usr/X11R6/man/.glimpse_filenames_index ; # !/usr/X11R6/man/.glimpse_filetimes ; # !/usr/X11R6/man/.glimpse_filters ; # !/usr/X11R6/man/.glimpse_index ; # !/usr/X11R6/man/.glimpse_messages ; # !/usr/X11R6/man/.glimpse_partitions ; # !/usr/X11R6/man/.glimpse_statistics ; # !/usr/X11R6/man/.glimpse_turbo ; # /usr/X11R6/man/man1 -> $(SEC_CRIT) (recurse = true) ; # /usr/X11R6/man/man2 -> $(SEC_CRIT) (recurse = true) ; # /usr/X11R6/man/man3 -> $(SEC_CRIT) (recurse = true) ; # /usr/X11R6/man/man4 -> $(SEC_CRIT) (recurse = true) ; # /usr/X11R6/man/man5 -> $(SEC_CRIT) (recurse = true) ; # /usr/X11R6/man/man6 -> $(SEC_CRIT) (recurse = true) ; # /usr/X11R6/man/man7 -> $(SEC_CRIT) (recurse = true) ; # /usr/X11R6/man/man8 -> $(SEC_CRIT) (recurse = true) ; # /usr/X11R6/man/man9 -> $(SEC_CRIT) (recurse = true) ; # /usr/X11R6/man/manl -> $(SEC_CRIT) (recurse = true) ; # /usr/X11R6/man/mann -> $(SEC_CRIT) (recurse = true) ; # ! /usr/X11R6/man/cat1 ; # ! /usr/X11R6/man/cat2 ; # ! /usr/X11R6/man/cat3 ; # ! /usr/X11R6/man/cat4 ; # ! /usr/X11R6/man/cat5 ; # ! /usr/X11R6/man/cat6 ; # ! /usr/X11R6/man/cat7 ; # ! /usr/X11R6/man/cat8 ; # ! /usr/X11R6/man/cat9 ; # ! /usr/X11R6/man/catl ; # ! /usr/X11R6/man/catn ; |
hoge# /usr/local/sbin/twadmin --create-polfile -S /usr/local/etc/tripwire/site.key /usr/local/etc/tripwire/twpol.txt hoge# Please enter your site passphrase: パスワード入力 hoge# Wrote policy file: /usr/local/etc/tripwire/tw.pol hoge# /usr/local/sbin/tripwire --init hoge# Please enter your local passphrase: パスワード入力 hoge# Parsing policy file: /usr/local/etc/tripwire/tw.pol hoge# Generating the database... hoge# *** Processing Unix File System *** hoge# Wrote database file: /var/db/tripwire/hoge.twd hoge# The database was successfully generated. |
hoge# /usr/local/sbin/tripwire --check hoge# *** Processing Unix File System *** hoge# . hoge# . hoge# . |
=============================================================================== Error Report: =============================================================================== No Errors ------------------------------------------------------------------------------- *** End of report *** Tripwire 2.3 Portions copyright 2000 Tripwire, Inc. Tripwire is a registered trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY; for details use --version. This is free software which may be redistributed or modified only under certain conditions; see COPYING for details. All rights reserved. |
hoge# /usr/local/sbin/tripwire --init hoge# Please enter your local passphrase: パスワード入力 hoge# Parsing policy file: /usr/local/etc/tripwire/tw.pol hoge# Generating the database... hoge# *** Processing Unix File System *** hoge# Wrote database file: /var/db/tripwire/hoge.twd hoge# The database was successfully generated. . |
ROOT =/usr/local/sbin POLFILE =/usr/local/etc/tripwire/tw.pol DBFILE =/var/db/tripwire/$(HOSTNAME).twd REPORTFILE =/var/db/tripwire/report/$(HOSTNAME)-$(DATE).twr SITEKEYFILE =/usr/local/etc/tripwire/site.key LOCALKEYFILE =/usr/local/etc/tripwire/adam.instat.ne.jp-local.key EDITOR =/usr/bin/vi LATEPROMPTING =false LOOSEDIRECTORYCHECKING =false MAILNOVIOLATIONS =true #改竄があった時のみ、メール送信の場合はfalse EMAILREPORTLEVEL =3 REPORTLEVEL =3 MAILMETHOD =SENDMAIL SYSLOGREPORTING =false MAILPROGRAM =/usr/local/sbin/sendmail -oi -t #MTAをpostfixに変更してるので/usr/sbin/sendmailから変更 SMTPHOST =xxx.xxx.xxx.xxx #使用するSMTPのIPアドレス SMTPPORT =25 #使用しているSMTPのポート番号（標準25） |
SIG_HI = 100 ; # Critical files that are significant points of vulnerability
(emailto = root@xxx.xxx.ne.jp) #送信するメールアドレスの追加(Tripwire Binariesの前に記述)
{ #中括弧を追加する（括弧でルール全体をくくる）
# Tripwire Binaries
(
rulename = "Tripwire Binaries",
severity = $(SIG_HI)
)
{
.
.
.
省略
rulename = "Security Control",
severity = $(SIG_HI)
)
{
/etc/group -> $(SEC_CRIT) ;
/etc/crontab -> $(SEC_CRIT) ;
}
} #中括弧を追加する（括弧でルール全体を閉じる）
|
hoge# /usr/local/sbin/twadmin --create-polfile -S /usr/local/etc/tripwire/site.key /usr/local/etc/tripwire/twpol.txt hoge# Please enter your site passphrase: パスワード入力 hoge# Wrote policy file: /usr/local/etc/tripwire/tw.pol hoge# /usr/local/sbin/twadmin --create-cfgfile -S /usr/local/etc/tripwire/site.key /usr/local/etc/tripwire/twcfg.txt hoge# Please enter your site passphrase: パスワード入力 hoge# Wrote policy file: /usr/local/etc/tripwire/tw.cfg |
hoge# /usr/local/sbin/tripwire -m t -e root@xxx.ne.jp |
hoge# /usr/local/sbin/tripwire --check -M |
#!/bin/sh /usr/local/sbin/tripwire --check -M /usr/local/sbin/tripwire --init -P パスワード |
#/etcにtripwire-check.shを作成した場合（３時２０分にチェック） 20 3 * * * root /etc/tripwire-check.sh > /dev/null |
Tripwire(R) 2.3.0 Integrity Check Report
Report generated by: root
Report created on: Mon Oct 6 16:10:01 2003
Database last updated on: Never
===============================================================================
Report Summary:
===============================================================================
Host name: xxx.xxx.ne.jp
Host IP address: 192.xxx.xxx.2
Host ID: None
Policy file used: /usr/local/etc/tripwire/tw.pol
Configuration file used: /usr/local/etc/tripwire/tw.cfg
Database file used: /var/db/tripwire/xxx.ixxx.ne.jp.twd
Command line used: /usr/local/sbin/tripwire --check -M
===============================================================================
Rule Summary:
===============================================================================
-------------------------------------------------------------------------------
Section: Unix File System
-------------------------------------------------------------------------------
Rule Name Severity Level Added Removed Modified
--------- -------------- ----- ------- --------
Invariant Directories 66 0 0 0
Sources 100 0 0 0
Temporary directories 33 0 0 0
Tripwire Data Files 100 0 0 0
* Local files 66 0 0 1
Tripwire Binaries 100 0 0 0
Libraries, include files, and other system files
100 0 0 0
System Administration Programs 100 0 0 0
User Utilities 100 0 0 0
X11R6 100 0 0 0
NIS 100 0 0 0
(/var/yp)
/etc 100 0 0 0
* Security Control 100 0 0 1
* Root's home 100 0 0 1
FreeBSD Kernel 100 0 0 0
FreeBSD Modules 100 0 0 0
(/modules)
/dev 100 0 0 0
Linux Compatibility 100 0 0 0
(/compat)
Total objects scanned: 20618
Total violations found: 3
===============================================================================
Object Detail:
===============================================================================
-------------------------------------------------------------------------------
Section: Unix File System
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
Rule Name: Local files (/usr/local/etc)
Severity Level: 66
-------------------------------------------------------------------------------
----------------------------------------
Modified Objects: 1
----------------------------------------
Modified object name: /etc/tripwire-check.sh
Property: Expected Observed
------------- ----------- -----------
* Mode -rw-r--r-- -rwxr-xr-x
* Size 47 48
* Modify Time Sun Oct 5 15:24:40 2003 Mon Oct 6 15:50:16 2003
* CRC32 BvONZ4 DMIkTO
* MD5 AWDOWJH9hvV9Xe9ByJg8zH D+UXywB+diU+rNccqgzO4e
-------------------------------------------------------------------------------
Rule Name: Security Control (/etc/crontab)
Severity Level: 100
-------------------------------------------------------------------------------
----------------------------------------
Modified Objects: 1
----------------------------------------
Modified object name: /etc/crontab
Property: Expected Observed
------------- ----------- -----------
* Size 744 816
* Modify Time Mon Oct 6 02:50:40 2003 Mon Oct 6 16:10:28 2003
* Change Time Mon Oct 6 02:50:40 2003 Mon Oct 6 16:10:28 2003
* CRC32 COtoA0 BgQlOn
* MD5 CTmdZFbBgUuj9zJm0/uzRo A0Gy//jkpHCmKDL1Wpo9u/
-------------------------------------------------------------------------------
Rule Name: Root's home (/root)
Severity Level: 100
-------------------------------------------------------------------------------
----------------------------------------
Modified Objects: 1
----------------------------------------
Modified object name: /root
Property: Expected Observed
------------- ----------- -----------
* Modify Time Mon Oct 6 02:50:26 2003 Mon Oct 6 16:10:07 2003
* Change Time Mon Oct 6 02:50:26 2003 Mon Oct 6 16:10:07 2003
===============================================================================
Error Report:
===============================================================================
No Errors
-------------------------------------------------------------------------------
*** End of report ***
Tripwire 2.3 Portions copyright 2000 Tripwire, Inc. Tripwire is a registered
trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;
for details use --version. This is free software which may be redistributed
or modified only under certain conditions; see COPYING for details.
All rights reserved.
|