Slashdot Mirror
Is Tripwire Still Relevent?
Deagol asks "I work for a good-sized University. I've heard that Tripwire and our software licensing department is negotiating for a site-license. I was asked to comment on whether our department would like to buy in. I personally lost interest in Tripwire when they went commercial (I guess seeing a well-respected research tool go proprietary soured the milk for me), and though I've toyed briefly with the 'open source' version, I mainly have experience with the Academic Source Release. Seeing how their demo is only a 'simulation' (how lame is that?), I can't get a feel for what the commercial version can really do for me. Does anyone know the value (if any) of commercial Tripwire over the free one; Are there open source packages that have made Tripwire obsolete?"
Check out ViperDB, written in perl, it does it's checks every 5 minutes, in a highly optimized way at that. I actually know the guy who wrote it, and when setting up software on his machine set off his pager something fierce.
Should we ask whether spellchecking is still relevAnt?
C'mon guys -- get the headlines right!
We use samhain. It's very nice because it can log to a remote host and store the filesystem database on a remote host as well. It also runs as a deamon and scans at a set interval. You can even make it change its name and hide its code in image files so as to trick hax0rs into thinking that its not installed.
The only thing I don't like about it is that I have it scheduled to check the machines every 10 mins, so if one of the junior admins changes something and forgets to reset the database I get an email every 10 mins until I reset it.
The homepage for samhain is http://la-samhna.de/samhain/
-----BEGIN GEEK CODE BLOCK----- Version: 3.12 GIT d? s: a-- C++++ UL++++ P++ L+++ E- W++ N o-- K- w--- O- M+ V PS+ P
is Osiris, which has an Apache-style syntax and a weird pseudo-free license. I haven't worked with enough filesystem integrity management systems (aka intrusion detection systems) to differentiate its use from Tripwire. My two cents.
I guess this will not answer your question about the advantage of the commercial tripwire above the open source one, but I use aide for some time now and it does a good job for me. I think it does the same as tripwire does (the version of 2 years ago, since it was the last time I used this).
. /etc/aide/aide.conf. See manual.html for information on this file.
[marc@scorpius marc]$ apt-cache show aide
Package: aide
Priority: optional
Section: admin
Installed-Size: 980
Maintainer: Mike Markley
Architecture: i386
Version: 0.9-2
Depends: libc6 (>= 2.3.1-1), debconf (>= 0.2.0)
Recommends: cron, mailx
Filename: pool/main/a/aide/aide_0.9-2_i386.deb
Size: 346316
MD5sum: a3610146e79608a34997450fdc56d74f
Description: Advanced Intrusion Detection Environment
AIDE creates a database from the regular expression rules that it finds
from the config file. Once this database is initialized it can be used to
verify the integrity of the files. It has several message digest algorithms
(md5,sha1,rmd160,tiger,haval,etc.) that are used to check the integrity of
the file. More algorithms can be added with relative ease. All of the usual
file attributes can also be checked for inconsistencies.
You will almost certainly want to tweak the configuration file in
Genius doesn't work on an assembly line basis. You can't simply say, "Today I will be brilliant."
Eye den't knew reelly, bet thenks fer esking !
The proper spelling is "relevant", Cliff.
% dict relevent
No definitions found for "relevent", perhaps you mean:
web1913: Relevant
About 4 months ago, a Windows-knowledgable colleague and my Unix-using self did a comparison of TripWire, ViperDB, Aide, Fcheck and another tool whose name escapes me. We were looking for speed, simplicity, effectiveness and portability *nix/Win32).
....". A little bit of scripting will do everything else for you.
FCheck ruled the day. It's easy to configure, works on *nix and Win32 (it's written in Perl), very fast in operation (We found Tripwire to be unusably slow/CPU-intensive for regularly scheduled checks) and passed every functional test we threw at it. It logs to syslog so you can send output to a remote machine. And it's GPL'd.
As for Tripwire's proprietary version, my colleague reckoned the only benefit was the GUI. Personally I don't see the point of a GUI on a security tool which is meant to run unsupervised. I suppose it does reporting etc. but really, what more do you need other than "This file changed at dd/mm/yy, hh:mm.ss. The change was
Yours Sincerely, Michael.
Do any of these have:
1) Central console to manage the application on servers across the Enterprise?
2) Runs on Cisco routers?
First off, if you only have to worry about a couple of machines, anything works pretty well.
Tripwire is good because it uses multiple hashing routines to figure out if something has changed (ie you can't pad a file with "0" until the hash is the same).
Additionally, the real strength in the commercial version of tripwire is the scalability. If you have hundreds of machines you need to monitor, the commercial version provides a central console which at a glance shows you what's going on across all your machines as far as changes. And the central console allows you to reconcile changes or revert to a known good state remotely.
All in all, if you only have a few boxen, don't buy it. If you have many and you don't want to spend all your time reconfiguring and updating a rules database, go for the commercial version.
I also was looking to use Tripwire mainly to occassionally scan the system to ensure that no important files had been modified (duh). I was extremely put off by the price and tone of the website.
If your main interest is simply to retain a database with checksums of files on your drive, and occassionally compare them for new files/changes - roll you own. I did and it was both easy an effective.
Simply stated, I use a configuration file to specify what directories and/or files should be scanned. Likewise, the configuration file has filters that will reject scanning files if any part of the filename matches the filter. The program reads the config and then goes out and reads the files on the drive. I use two different checksum schemes that produce checksum strings of about 80 characters each. These are stored in a database with the absolute file name, it's inode, it's last modify date, it's size, and the checksums.
When the program scans it merely checks the files against the database. If a file is new, it reports it as new to a log and adds it to the database. If a file has changed it reports it as changed to the log and then corrects the information in the database to reflect the change. If no change has occured, nothing happens to the database.
The program spits out little run-time facts about how many files it's scanning, number new, number change and number unchanged. When the run is completed all you have to do is glance at the log and determine if any of the files that changed in the log are a concern and need to be checked out.
There are a couple of advantages to do it yourself... first, no fee to Tripwire. Second... Tripwire is a known product. If you get a hacker in your system and he finds tripwire you can bet he'll try to do something to circumvent it. On the other hand, having written your own tripwire (and don't call it tripwire) - the hacker will not know this, not be familiar with your mechanism, and thus, will be unable to circumvent it. And finally, if your scanner is pretty good, clean and useable, it becomes a nice competitive product against Tripwire.
"Intrusion Detection" has over 50 systems. I use Claymore (utterly simply, has saved my arse completely on one occasion).
Tripwire has mindshare - not much else it seems.
"And the meaning of words; when they cease to function; when will it start worrying you?"
Tripwire basically does business by cold calling companies and trying to get in touch with somebody that has the correct ballance of knowledge to spending authority. They then try to convince this stupid person with the checkbook that their company is going to be hacked off the face of the earth if you don't buy. Then, if you still say no, they keep calling back once a month trying to find somebody else who will say yes, but with a line that goes something like "We were in discussions already with person x at your company, and you just weren't ready to buy yet, and we'd like to see if you're ready to go forward." Blech. Telemarketing sucks.
I would not count myself an expert here, but I found the discussion in Chpt 2 of "Hacking Linux Exposed:Linux Security Secrets and Solutions" helpful. They recommend either AIDE or Nabou
I spent a few weeks checking out various opensource and commercial packages. If you have less then 10 or 20 machines then you can use almost anything including the academic source release of tripwire. If you have more then 20 machines none of the opensource products that I found support centralized management/reporting/logging which is key to a large number or systems. Tripwire has a great product commercially wise but they are very expensive. I highly suggest you check out INTACT from pedestal software instead of tripwire. They are a third the price and have all the same functionality of tripwire and then some... I demo'd them for quite a while and it works very well on solaris/linux/windows. I dont have any relationship to them.. I was just impressed with their product.
I have had alot of sucess with prelude.
a company i used to work for used symantec's intruder alert on the inside of our network monitoring our servers and snort outside outside of the firewall in a dmz monitoring traffic going to the firewall.
Large print giveth, and the small print taketh away
For rpm based distros you already have a database of checksums for most of the files on your system and rpm has a way to check them.
So the poor man's tripwire is simply to run the verify command for all installed rpms like so:
rpm -V `rpm -qa`
It is also useful as a simple way to figure out what legitimate changes have been made to a vanilla install since it will tell you what config files have been modified since the install.
if they're commercial and can't give you a good idea why the commercial version is better, i don't know who can.
Quote
I've heard that Tripwire and our software licensing department is negotiating for a site-license.
End Quote
'is negotating?'
Try 'are negotiating'
I have been wondering about this, but I figured I would have to put it together myself: Are there any checksum programs that integrate with package managers?
Specifically, I am thinking about Debian packages with md5sums. Separating the files verifiably changed by package would be helpful in tracking unexpected file modifications (due to lower volume) and for noting unsigned packages (not everything in Debian is signed yet).
i use sentinel http://freshmeat.net/projects/sentinel/?topic_id=4 3 ..its a hard core unix only tool but its compact and very fast (can max out the HDD). GPL source, really really lame graphical interface but it works ok in command line mode.
Also (for Windows only) try Data Sentinel available from Ionx: http://www.ionx.co.uk They have a 30 day trial on their website - I tried it and it looks pretty damn good. Very easy to use, and quite cheap.