Monitoring file integrity with FC4 - Tripwire??

[Scot L. Harris]

On Thu, 2005-09-29 at 14:34, Hahnel William J (CI) wrote:
> I'm looking for a mechanism to monitor the integrity of critical files
> on my FC4 servers.  I understand Tripwire is the application to do it
> but I am having no success getting it set up.  I downloaded the source
> from SourceForge but can not follow how to set it up.  I could not
> locate an RPM for the application.
>  
> Any help getting something set up would be greatly appreciated.
>  
> Thanks!
>  
> Bill Hahnel
> CI National Operations Center

You should find a tripwire rpm in the extras repository for Fedora.

Note: the setup script is now located in
/usr/sbin/tripwire-setup-keyfiles.  It explains this in one of the
readme files that comes with the rpm.  That file will setup the key
files for your system.  You will need to edit the policy file to get
things configured the way you want and to eliminate items which are not
installed on your system or which you don't want to monitor.  Then run
through the normal steps for setting up the database and running the
report.  

One alternative to tripwire is AIDE.  The last time I looked at it
though it seemed to be immature and not quite ready.  It did not sign
the policy or database files which means to setup this up in a secure
manner you would have to arrange to keep those files off line or on read
only media.  

I personally prefer tripwire.  I always found this RedHat documentation
to be useful when setting up or updating tripwire:

http://www.redhat.com/docs/manuals/linux/RHL-7.3-Manual/ref-guide/ch-tripwire.html

The only real change from those docs to now is the initialization script
which is /usr/sbin/tripwire-setup-keyfiles now.

I also came across this posting.  I have not tried this script but if it
does what it claims it could be very useful.  As always I would
recommend you manually check the policy file to make sure it is
monitoring the files you want on your system.

http://moongroup.com/pipermail/shell.scripting/2004-March/000849.html

If you use that script and it works let us know.