Tripwire Enterprise Server – Basic Tasks Doreen Meyer and Vincent Fox UC Davis, Information and Education Technology July 12, 2006

Topics Server install Q&A Server install Q&A Understanding the UI Understanding the UI Settings manager Settings manager Your first node! Your first node! o Importing useful rules o Agent install o The managers: nodes, rules, actions, tasks, logs o Baselining, version Checks, promotion

Server Install Single-server, just run the installer Single-server, just run the installer Dual-server, you will need to add parameters to the install command Dual-server, you will need to add parameters to the install command Windows cannot install over TS Windows cannot install over TS STORE THOSE PASSWORDS! STORE THOSE PASSWORDS! *Note: in 5.5 problems using a Services Password > 8 chars *Note: in 5.5 problems using a Services Password > 8 chars

Server firewall/NAT Firewall, see Installation Guide, Chapter 1. Network requirements Firewall, see Installation Guide, Chapter 1. Network requirements NAT, see Reference Guide, Chapter 4. System Properties NAT, see Reference Guide, Chapter 4. System Properties

Tripwire UI The TE GUI has many elements of a familiar desktop, but is not. This can lead to frustration and broken mice. The TE GUI has many elements of a familiar desktop, but is not. This can lead to frustration and broken mice. Zones of the console Zones of the console

TE Console Areas

TE Console Flubs

Server Settings User preference settings User preference settings System preferences System preferences server server

Useful Account Setting

System Preferences Shorten session timeout to 10 minutes Shorten session timeout to 10 minutes

Servers

Administration Settings Configure login method Configure login method Creating roles Creating roles Creating a user group Creating a user group Creating users Creating users

Configure Login Method

Roles

Modifying Roles

Creating User Groups Functional groups usually by role Functional groups usually by role Obvious groupings: staff/admins, operations, management Obvious groupings: staff/admins, operations, management

Node Setup Tasks Import TFS and/or UCD-basic rulesets Import TFS and/or UCD-basic rulesets Install agent on a node Install agent on a node Create an action Create an action Use tasks to associate rule, node, action, and schedule a time to run. Use tasks to associate rule, node, action, and schedule a time to run. Create a baseline for the node Create a baseline for the node Wait. Example for a rule with 7,000 elements stored, took ~600 seconds. Wait. Example for a rule with 7,000 elements stored, took ~600 seconds.

Import Useful Rules TFS rules very generic, usually result in many elements stored. TFS rules very generic, usually result in many elements stored. UCD rules leaner, meaner. UCD rules leaner, meaner. Rule names need to be unique or collision will occur. Rule names need to be unique or collision will occur.

Install the Agent Software Install as Administrator Install as Administrator Enter port + services password Enter port + services password Punch holes in firewall! Punch holes in firewall! There is a silent install option, see Users Guide, Ch. 2, Installation Procedures for TE Agent There is a silent install option, see Users Guide, Ch. 2, Installation Procedures for TE Agent

Agent Install

Firewall on Client

Create Action

Move Discovered Node

Create First Task We just want a Check Rule Task for our example

Create First Task

Test That It Works Modify a watched element Modify a watched element Run the task, or do a node check Run the task, or do a node check Note the change or check your Note the change or check your Take action on the intrusion! Or, just promote the changes. Take action on the intrusion! Or, just promote the changes.

Node Manager Adding a node group Adding a node group Linking a node Linking a node Elements for file system nodes Elements for file system nodes Element versions Element versions Node viewing filter Node viewing filter

Adding a Node Group

Linking a Node

Link Symbol

TE Symbols Exposed

Node Elements

Element Versions

Node Viewing Filter

Without filtering, TMI

Now we can see the trees

Viewing Rules

Rule Specifiers

Action Manager Viewing Actions Viewing Actions Creating an action Creating an action Creating an SNMP action Creating an SNMP action Creating an execution action (locally or on TE server) Creating an execution action (locally or on TE server)

An Execution Action

An Execution Action echoing the file name of a changed element to a file

Task Manager Viewing tasks Viewing tasks Creating and deleting tasks Creating and deleting tasks

Task Manager

Log Manager Viewing logs Viewing logs Sorting and filtering Logs Sorting and filtering Logs

Log Manager

Log Manager - Search

The Baseline- What is Happening? Baselining I/O intensive on DB disks Baselining I/O intensive on DB disks Recommend baselining only a small number of systems at once. Recommend baselining only a small number of systems at once.

Snapshot defined Temporary record of the monitored objects current attributes. In a baseline execution, this would become the baseline version. In a version check this is the now state we compare the baseline against. Temporary record of the monitored objects current attributes. In a baseline execution, this would become the baseline version. In a version check this is the now state we compare the baseline against.

Version Check

Viewing Changes Difference Viewer Difference Viewer

Promotion Promote selected versions Promote selected versions Promote by match Promote by match Promote by reference Promote by reference Promote by package Promote by package

Promote Selected Versions Promote current snapshot(s) to baseline. Select using the GUI. Promote current snapshot(s) to baseline. Select using the GUI.

Homework for July 26 Install an agent and associate it with a basic rule or rule set and a task or action Install an agent and associate it with a basic rule or rule set and a task or action Practice the procedures Practice the procedures Deployment options Deployment options

Training Schedule July 12: adding and configuring a node using the basic rule set July 12: adding and configuring a node using the basic rule set July 26: creating and modifying rules July 26: creating and modifying rules Aug 1 or 8?: reports, dashboard, deployment steps Aug 1 or 8?: reports, dashboard, deployment steps

Resources - Rulesets and presentations - Rulesets and presentations - mailing list - mailing list Vincent Fox - Vincent Fox - Doreen Meyer - Doreen Meyer - Bob Ono - Bob Ono - Software - Software -