1. Security SIG: Introduction to Tripwire Chris Harwood John Ives

2. What is Tripwire?  Monitors ‘important’ file and registry values and properties (like access times, flags, owner, etc)  Enables Admins to detect files that are added, modified or deleted  Provides a history of what changes during patching  Two Components (for today’s discussion) Tripwire for Servers (command line) Tripwire Manager (GUI front end)

3. What can run Tripwire?  Compaq Tru64 UNIX 4.0F, 4.0G, 5.0A, 5.1, 5.1A & 5.1B  FreeBSD 4.5, 4.6, 4.7, 4.10 & 5.3  HP-UX 10.20, 11.0, 11i v1 & 11i v2  IBM AIX 4.3.3, 5.1, 5.2 & 5.3  Linux (kernel 2.2 and glibc 2.x or higher)  Red Hat Enterprise Linux 3 & 4 AS, WS & ES  Solaris (SPARC) 2.6, 7, 8, 9 & 10  Windows NT 4.0, 2000, 2003 & XP Pro

4. How do you get Tripwire?  Licensed for use by all UC campuses  Locally it is distributed via http://softdist.berkeley.edu/  Fill out the form and fax in the appropriate paperwork  Download instructions are sent via email

5. Tripwire For Servers  Command Line Utility  Keeps encrypted database of File/Registry Attributes (including 4 hashing algorithms – HAVAL, MD5, SHA and CRC-32)  Can detect changes to 29 object properties and 21 Registry keys/values on windows and 21 object properties on UNIX  Can Notify of changes via syslog, email or SNMP  Can output results in XML or HTML

6. Object Properties - Windows  Archive flag  Read-only flag  Hidden flag  Offline flag  Temporary flag  System flag  Directory flag  Last access time  Last write time  Create time  File size  Turns on event tracking for that object  MS-DOS 8.3 name  NTFS Compressed flag  NTFS Owner SID  NTFS Group SID  NTFS DACL  NTFS SACL  Security descriptor control  Size of security descriptor  CRC-32  MD5  SHA  HAVAL  Number of NTFS streams  CRC-32 hash of all alternative data streams  MD5 hash of all alternative data streams  SHA hash of all alternative data streams  HAVAL hash of all alternative data streams

7. Registry Properties - Windows  Registry Key Objects Last write time Owner SID Group SID DACL SACL Security descriptor control Size of security descriptor for the key Name of class Number of subkeys Maximum length of subkey name Maximum length of classname Number of values Maximum length for value name Maximum length of data for any value in the key Turns on event tracking for that object  Registry Value Objects Type of value data Length of value data CRC-32 hash of value data MD5 hash of value data SHA hash of value data HAVAL hash of value data

8. Object Properties - UNIX  File permissions  Inode number  Number of links (inode reference count)  User ID of owner  Group ID of owner  File ize  Device number of the disk where the inode for the file is stored  For device object only; number of the device to which the inode points  Number of blocks allocated  Modification timestamp  Inode creation/modification timestamp  File size (violated if file is not larger than its last recorded size)  Access timestamp  Object Event tracking  Flags  CRC-32  MD5  SHA  HAVAL  ACL settings  Inode generation number

9. Pass Phrases  Local Passphrase Used to protect the Database and (optionally) report files  Site Passphrase Used to protect the policy and configuration files  Manager Passphrase Stores the local and site passwords of each server using triple-DES encryption with a 168 bit key length

10. Demonstration Installing Tripwire For Servers on Windows

11. Demonstration Tripwire For Servers Command Line Options and Default Policy

12. Installation on Linux  Glibc must be installed Up2date –u glibc or glibc-devel  Install the agent  Site key & local key  Mail method SMTP for relay Sendmail for localhost  SNMP set to no  IP address port 1169 Firewall rules manager to server ( 1024-65535 to 1169)  Startup scripts  Start agent  Register in Tripwire Manager

13. Demonstration Installing Tripwire for servers on Linux

14. Tripwire Manager  GUI for managing (Policy, Schedule, etc) on Tripwire for Servers  Written in Java (supported on Solaris 7-9, Windows NT4-2003 and RedHat Linux 7-9 & Enterprise Linux 3 & 4 AS, WS, & ES)  Can manage multiple Tripwire for Servers Installations  Uses SSL to communicate with Tripwire for Servers (bi-directional authentication)

15. Demonstration Installing Tripwire Manager on Windows

16. Registering a server  Add Machine Hostname Group Address Port

17. Demonstration Registering Server with Manager

18. Demonstration Using Tripwire Manager to edit Policy, Settings and Schedule

19. Initial Config  Edit config file Event tracking Mail no violation reports Global email  Initialize the database (8 min)  Perform integrity check (10 min)  Update policy file Don’t overwrite

20. Post Integrity Check  View Report Objects  UNIX  Windows  Update database Update, don’t approve violations  Re-run integrity check Continue until status is green

21. Automation & Reporting  Configure schedules Nightly  Full integrity check Periodical  System configuration files  Other critical application files or directories  Text or HTML reports Level 3 Concise Text format HTML reports can cause SMTP issues

22. Questions and Answer