Is Tripwire Still Relevent? 49
Deagol asks "I work for a good-sized University. I've heard that Tripwire and our software licensing department is negotiating for a site-license. I was asked to comment on whether our department would like to buy in. I personally lost interest in Tripwire when they went commercial (I guess seeing a well-respected research tool go proprietary soured the milk for me), and though I've toyed briefly with the 'open source' version, I mainly have experience with the Academic Source Release. Seeing how their demo is only a 'simulation' (how lame is that?), I can't get a feel for what the commercial version can really do for me. Does anyone know the value (if any) of commercial Tripwire over the free one; Are there open source packages that have made Tripwire obsolete?"
ViperDB (Score:3, Informative)
Re:Or better... (Score:1, Offtopic)
It's like ketchup on your tie -- off-topic, distracting, and unprofessional. Note that this is not posted as an anonymous coward. I sincerely believe what I'm saying and am not just sniping.
Re:Or better... (Score:2)
Re:Or better... (Score:1)
Re:Or better... (Score:1)
I would at least silently fix the headline, even if making the usual excuses about their incredible productivity barring even trivial accuracy were too painful. Heck, I make spelling errirs and typpoes all the time, and would fix them later if I could.
Yes, I do realize this is in vain. I'm just a noodge (sp?) -- and dislike petty big-fish-in-little-pond arrogance. (Says the petty spelling cop.)
Re:Or better... (Score:1)
Oh yeah, definitely. I'd say 90% of the troll and offtopic mods are editors. You can usually tell after you have been here long enough, which is user moderation and which is editor modding.
For example, suppose you post something pro-gun-ownership in a CmdrTaco story, or a story you know he is interested in. You get 4 up mods and 2 overrated mods... which are later cancelled by more upmods. That kind of thing is pretty obvious. Or suppose you get a very early post in a story that seems a little trollish, but it really insightful, which is instantly downmodded, and usually later modded back up...
Anyway, it's not always clear cut, but I can say with pretty good certainty which are editor mods and which are user mods. Modding in older stories is also an editor thing. A lot of the time they might slap down threads before a story gets archived, threads they don't want to be saved forever. For example this thread, which will likely be slapped down in the next day or two.
Anyway, all in all I think the editors do a pretty good job, considering the power they wield. They do have pet peeves though, and meta-discussion in offtopic threads such as this one is one of them. Taco hates meta threads in general. Draw what conclusions you like from that.
Re:Or better... (Score:2)
I'm not sure editors should have unlimited points. Unlike a regular publication this is much more a collaboration between writers and editors, with the writers and readers doing a lot of editing themselves. That editors can override as they please says that they know better than anyone else, which is doubtful. Perhaps they miss the days when they did all the moderation, before that became unfeasible and they had to grudgingly "allow" users to do it. Why not "tag" editor mods? Might get some interesting reader feedback when they detect tampering. One post of mine accumulated like 10 points to end up about where is started, I believe between people who thought it was trollish and others who thought it provoctive. I wonder what the record for dueling points might be.
Whatever. However godlike I thought I was, I would still fix the fscking headline once it had been brought to my attention. And although our conversation is off-topic, this is where the improper (?) peevish modding took place -- they picked the time and place. Critiques should be attached to concrete examples. Besides, if editors act improperly on a trivial issue, what else goes on with, say, an editor's politics?
Grammar != relevant (Score:1)
Quote
I've heard that Tripwire and our software licensing department is negotiating for a site-license.
End Quote
'is negotating?'
Try 'are negotiating'
Re:Grammar != relevant (Score:1)
This provides a marginal improvement, though I think it is better prose. However, a misspelling in the headline that you refuse to correct -- the root of this loose thread -- makes you look foolish. (Even the NYT makes mistakes in big type, such as printing "priviledge" I once saw, but once the ink is dry and the paper is sold, what can they do?)
Re:Grammar != relevant (Score:1)
See e.g. The Beacon Handbook, pg. 177.
Re:Grammar != relevant (Score:1)
See also rule #5 at this page [troyst.edu], or this link [wisc.edu].
I love it when people correct the grammar of others, when they themselves are wrong. Morons.
Where I work... (Score:3, Informative)
The only thing I don't like about it is that I have it scheduled to check the machines every 10 mins, so if one of the junior admins changes something and forgets to reset the database I get an email every 10 mins until I reset it.
The homepage for samhain is http://la-samhna.de/samhain/ [la-samhna.de]
Another example - (Score:3, Informative)
Re:Another example - (Score:1)
I fucking love COE but I never seem to run into fans.
Aide (Score:4, Informative)
[marc@scorpius marc]$ apt-cache show aide
Package: aide
Priority: optional
Section: admin
Installed-Size: 980
Maintainer: Mike Markley
Architecture: i386
Version: 0.9-2
Depends: libc6 (>= 2.3.1-1), debconf (>= 0.2.0)
Recommends: cron, mailx
Filename: pool/main/a/aide/aide_0.9-2_i386.deb
Size: 346316
MD5sum: a3610146e79608a34997450fdc56d74f
Description: Advanced Intrusion Detection Environment
AIDE creates a database from the regular expression rules that it finds
from the config file. Once this database is initialized it can be used to
verify the integrity of the files. It has several message digest algorithms
(md5,sha1,rmd160,tiger,haval,etc.) that are used to check the integrity of
the file. More algorithms can be added with relative ease. All of the usual
file attributes can also be checked for inconsistencies.
You will almost certainly want to tweak the configuration file in
Re: Aide (Score:2, Informative)
This was before version 2 came out; I never got around to checking that out. Aide is up from 0.7 to 0.9, at least. 0.9 seemed a little faster than 0.7.
As a disclaimer: I'm not sending the output of Aide to a database, or to another machine, or anything very fancy; I'm just getting a flat text file and running version tracking on that.
Is Tripwire Still Relevent? (Score:1, Funny)
FCheck (Score:5, Informative)
FCheck [geocities.com] ruled the day. It's easy to configure, works on *nix and Win32 (it's written in Perl), very fast in operation (We found Tripwire to be unusably slow/CPU-intensive for regularly scheduled checks) and passed every functional test we threw at it. It logs to syslog so you can send output to a remote machine. And it's GPL'd.
As for Tripwire's proprietary version, my colleague reckoned the only benefit was the GUI. Personally I don't see the point of a GUI on a security tool which is meant to run unsupervised. I suppose it does reporting etc. but really, what more do you need other than "This file changed at dd/mm/yy, hh:mm.ss. The change was
Re:FCheck (Score:2, Informative)
questions (Score:2, Interesting)
1) Central console to manage the application on servers across the Enterprise?
2) Runs on Cisco routers?
Re:questions (Score:3, Informative)
If you have so many servers that managing them individually is not an option, then what you need is a general solution to the management problem, not a specific solution for every piece of software you run.
For command line tools, manymaint [nist.gov] (a nice Expect [nist.gov] script) is one simple and free solution.
As for doing checks of routers, you could just use tftp to download configs to a server on a scheduled basis and run your checks there.
Computing is fun when you use your imagination to solve a problem (even an easy one like this) creatively, instead of asking "Here's my niche problem, where is the expensive niche product from a faceless bland corporation that fixes it?".
Commercial Tripwire (Score:4, Informative)
Tripwire is good because it uses multiple hashing routines to figure out if something has changed (ie you can't pad a file with "0" until the hash is the same).
Additionally, the real strength in the commercial version of tripwire is the scalability. If you have hundreds of machines you need to monitor, the commercial version provides a central console which at a glance shows you what's going on across all your machines as far as changes. And the central console allows you to reconcile changes or revert to a known good state remotely.
All in all, if you only have a few boxen, don't buy it. If you have many and you don't want to spend all your time reconfiguring and updating a rules database, go for the commercial version.
Re:Commercial Tripwire (Score:3, Informative)
Re:Commercial Tripwire (Score:1)
> The central console is for windows only.
That is not true -- the commerical Tripwire management console runs on Solaris, Windows, and Linux.
One option... (Score:3, Insightful)
I also was looking to use Tripwire mainly to occassionally scan the system to ensure that no important files had been modified (duh). I was extremely put off by the price and tone of the website.
If your main interest is simply to retain a database with checksums of files on your drive, and occassionally compare them for new files/changes - roll you own. I did and it was both easy an effective.
Simply stated, I use a configuration file to specify what directories and/or files should be scanned. Likewise, the configuration file has filters that will reject scanning files if any part of the filename matches the filter. The program reads the config and then goes out and reads the files on the drive. I use two different checksum schemes that produce checksum strings of about 80 characters each. These are stored in a database with the absolute file name, it's inode, it's last modify date, it's size, and the checksums.
When the program scans it merely checks the files against the database. If a file is new, it reports it as new to a log and adds it to the database. If a file has changed it reports it as changed to the log and then corrects the information in the database to reflect the change. If no change has occured, nothing happens to the database.
The program spits out little run-time facts about how many files it's scanning, number new, number change and number unchanged. When the run is completed all you have to do is glance at the log and determine if any of the files that changed in the log are a concern and need to be checked out.
There are a couple of advantages to do it yourself... first, no fee to Tripwire. Second... Tripwire is a known product. If you get a hacker in your system and he finds tripwire you can bet he'll try to do something to circumvent it. On the other hand, having written your own tripwire (and don't call it tripwire) - the hacker will not know this, not be familiar with your mechanism, and thus, will be unable to circumvent it. And finally, if your scanner is pretty good, clean and useable, it becomes a nice competitive product against Tripwire.
Re:One option... (Score:1)
I would think the most obvious attack would be to add ignore-patterns to the configuration file; or, since you're likely to catch a modification to the that (I assume you mod it yourself occasionally), just modify the script to ignore whatever he's done to your filesystem. Or he could update the checksums in your DB by hand. And so on.
Re:One option... (Score:2)
First, my trip program is not a 'script'. It's a C program and the source is not stored on the system. Second, it only exists in a private account and to run it I go super user and run it. It will not run otherwise. Third, I do not put it in a cron and it does not appear in any log files. Certainly, when I DO run it, it appears in the process table but the name of the program is inocculous (e.g., you would never realize it was what it was). The database we use is also prioprietary and not commercial.
These things are fairly obvious, and they would apply to Tripwire as well. If your using tripwire you certainly want to hide that fact as much as possible - so putting it in a CRON would be plain silly.
The point is, while it is not totally fool proof, rolling your own and being decerning on how you run it simply makes it harder, that's all. At some point too much time will be wasted looking and then trying to figure out how to deal with it. 3rd party programs by their very commercial nature are better understood and easier to circumvent (e.g., the more popular the commercial program is, the larger the chance that vulenerabilites are well known. A hand rolled obscure program easily falls between the cracks and can become invisible and thus effective).
Of course, an even more effective thought would be to actually HAVE something that looks like tripwire (e.g., proper directories and files) running in the cron. Then the haxor thinks they have it and never realize there's a little 'ksh' that's not a 'ksh' (and no, ours is not called 'ksh') watching 'em.
Re:One option... (Score:3, Insightful)
1) Tripwire and co. are interuder DETECTORS, i.e. after the fact. Your system is already comprimised.
2) The data (checksums etc) must be on read only media, that cannot be altered no matter how what privilages you have to the system.
3) The kernel should be assumed to be comprimised. This means to check your system, you must reboot the system to check your system.
The alternative is not as secure, but easier, is to have a hardened kernel which makes root have limited access, and does not allow kernel modules, and does not allow raw memory access.
So many tools - so little time! (Score:2, Informative)
"Intrusion Detection" has over 50 systems. I use Claymore (utterly simply, has saved my arse completely on one occasion).
Tripwire has mindshare - not much else it seems.
Tripwire's sales methods suck. (Score:2)
Re:Tripwire's sales methods suck. (Score:1)
Check out "Hacking Linux" (Score:1)
Just finished investigating host based intrusion (Score:3, Informative)
Poor man's tripwire (Score:2)
So the poor man's tripwire is simply to run the verify command for all installed rpms like so:
rpm -V `rpm -qa`
It is also useful as a simple way to figure out what legitimate changes have been made to a vanilla install since it will tell you what config files have been modified since the install.
if they're commercial... (Score:2)
Integration with package managers? (Score:1)
Specifically, I am thinking about Debian packages with md5sums. Separating the files verifiably changed by package would be helpful in tracking unexpected file modifications (due to lower volume) and for noting unsigned packages (not everything in Debian is signed yet).