古くからあるIDS装置として稼働するTripwireの紹介です。実は最近になってこれの有償製品があることをしりましたが、フリー 版でも十分使える技術です。不正侵入をされたサーバでは日常的に使うコマンドを書き換えられ、侵入されていることに気づかせないようにするのが一般的です。psやlastコマンドなどがその対象です。
tripwireではそういった主要なファイルやディレクトリなどが書き換えられていないかをチェックするツールです。tripwireはyumからインストール可能です。
# yum install tripwire # rpm -qa | grep tripwire tripwire-2.4.1.2-11.el6.i686 |
tripwireの初期設定を行います。
# /usr/sbin/tripwire-setup-keyfiles ---------------------------------------------- The Tripwire site and local passphrases are used to sign a variety of files, such as the configuration, policy, and database files. Passphrases should be at least 8 characters in length and contain both letters and numbers. See the Tripwire manual for more information. ---------------------------------------------- Creating key files... (When selecting a passphrase, keep in mind that good passphrases typically have upper and lower case letters, digits and punctuation marks, and are at least 8 characters in length.) Enter the site keyfile passphrase:************** (サイトキーを入力) Verify the site keyfile passphrase:************** (再度入力) Generating key (this may take several minutes)...Key generation complete. (When selecting a passphrase, keep in mind that good passphrases typically have upper and lower case letters, digits and punctuation marks, and are at least 8 characters in length.) Enter the local keyfile passphrase: ************** (ローカルキーを入力) Verify the local keyfile passphrase: ************** (再度入力) Generating key (this may take several minutes)...Key generation complete. ---------------------------------------------- Signing configuration file... Please enter your site passphrase: ************** (サイトキーを入力) Wrote configuration file: /etc/tripwire/tw.cfg A clear-text version of the Tripwire configuration file: /etc/tripwire/twcfg.txt has been preserved for your inspection. It is recommended that you move this file to a secure location and/or encrypt it in place (using a tool such as GPG, for example) after you have examined it. ---------------------------------------------- Signing policy file... Please enter your site passphrase: ************** (サイトキーを入力) Wrote policy file: /etc/tripwire/tw.pol A clear-text version of the Tripwire policy file: /etc/tripwire/twpol.txt has been preserved for your inspection. This implements a minimal policy, intended only to test essential Tripwire functionality. You should edit the policy file to describe your system, and then use twadmin to generate a new signed copy of the Tripwire policy. Once you have a satisfactory Tripwire policy file, you should move the clear-text version to a secure location and/or encrypt it in place (using a tool such as GPG, for example). Now run "tripwire --init" to enter Database Initialization Mode. This reads the policy file, generates a database based on its contents, and then cryptographically signs the resulting database. Options can be entered on the command line to specify which policy, configuration, and key files are used to create the database. The filename for the database can be specified as well. If no options are specified, the default values from the current configuration file are used. |
次に以下のコマンドでTripwireを初期化します。
# tripwire --init Please enter your local passphrase: |
上記で設定したローカルキーを入力すると初期化が始まりますが、/etc/tripwire/twpol.txtに記載されているが実際には存在しないコマンドなどがあると、その数だけのwarningが出力されます。(多分、かなりの数が出力されると思います)
その数だけ手動で修正していくのはかなり骨の折れる作業となりますのでCentOS 自宅サーバで見つけたperlスクリ プトで整合性をとります。
# perl twpolmake.pl /etc/tripwire/twpol.txt > /etc/tripwire/twpol.txt.new # mv /etc/tripwire/twpol.txt /etc/tripwire/twpol.txt.old # mv /etc/tripwire/twpol.txt.new /etc/tripwire/twpol.txt |
上記変更だけでは有効にはならず、以下のコマンドを実行して署名したポリシーファイル(バイナリファイル)を用意します。
tripwireはこのファイル(/etc/tripwire/tw.pol)を元にファイルのチェックを行います。
# twadmin --create-polfile -S /etc/tripwire/site.key /etc/tripwire/twpol.txt Please enter your site passphrase: Wrote policy file: /etc/tripwire/tw.pol |
tripwireの動作設定を変えた場合は/etc/tripwire/twcfg.txtに変更を加えます。
# vi /etc/tripwire/twcfg.txt ROOT =/usr/sbin POLFILE =/etc/tripwire/tw.pol DBFILE =/var/lib/tripwire/$(HOSTNAME).twd REPORTFILE =/var/lib/tripwire/report/$(HOSTNAME)-$(DATE).twr SITEKEYFILE =/etc/tripwire/site.key LOCALKEYFILE =/etc/tripwire/$(HOSTNAME)-local.key EDITOR =/bin/vi LATEPROMPTING =false LOOSEDIRECTORYCHECKING =false MAILNOVIOLATIONS =false # 何もエラーがなければメール送信しない EMAILREPORTLEVEL =4 # ログレポートを最高レベルに REPORTLEVEL =4 # ログレポートを最高レベルに MAILMETHOD =SENDMAIL SYSLOGREPORTING =false MAILPROGRAM =/usr/sbin/sendmail -oi -t |
これもこのままでは有効とならず以下のコマンドを実行して変更を有効にします。
# twadmin --create-polfile -S /etc/tripwire/site.key /etc/tripwire/twcfg.txt Please enter your site passphrase: Wrote policy file: /etc/tripwire/tw.cfg |
このあと、再度tripwireを初期化します。
# tripwire --init Please enter your local passphrase: Parsing policy file: /etc/tripwire/tw.pol Generating the database... *** Processing Unix File System *** Wrote database file: /var/lib/tripwire/xxyy.jp.twd The database was successfully generated. |
次のコマンドでチェックを行います。
# tripwire --check
Parsing policy file: /etc/tripwire/tw.pol
*** Processing Unix File System ***
Performing integrity check...
Wrote report file: /var/lib/tripwire/report/xxyy.jp-20121129-165306.twr
Open Source Tripwire(R) 2.4.1 Integrity Check Report
Report generated by: root
Report created on: 2012年11月29日 16時53分06秒
Database last updated on: Never
===============================================================================
Report Summary:
===============================================================================
Host name: xxyy.jp
Host IP address: Unknown IP
Host ID: None
Policy file used: /etc/tripwire/tw.pol
Configuration file used: /etc/tripwire/tw.cfg
Database file used: /var/lib/tripwire/xxyy.jp.twd
Command line used: tripwire --check
===============================================================================
Rule Summary:
===============================================================================
-------------------------------------------------------------------------------
Section: Unix File System
-------------------------------------------------------------------------------
Rule Name Severity Level Added Removed Modified
--------- -------------- ----- ------- --------
Invariant Directories 66 0 0 0
Temporary directories 33 0 0 0
Tripwire Data Files 100 0 0 0
Critical devices 100 0 0 0
(/proc/kcore)
User binaries 66 0 0 0
Tripwire Binaries 100 0 0 0
Libraries 66 0 0 0
Operating System Utilities 100 0 0 0
Critical system boot files 100 0 0 0
File System and Disk Administraton Programs
100 0 0 0
Kernel Administration Programs 100 0 0 0
Networking Programs 100 0 0 0
System Administration Programs 100 0 0 0
Hardware and Device Control Programs
100 0 0 0
System Information Programs 100 0 0 0
Application Information Programs
100 0 0 0
(/sbin/rtmon)
Shell Related Programs 100 0 0 0
(/sbin/getkey)
Critical Utility Sym-Links 100 0 0 0
Shell Binaries 100 0 0 0
System boot changes 100 0 0 0
OS executables and libraries 100 0 0 0
Critical configuration files 100 0 0 0
Security Control 100 0 0 0
Login Scripts 100 0 0 0
Root config files 100 0 0 0
Total objects scanned: 20167
Total violations found: 0
===============================================================================
Object Summary:
===============================================================================
-------------------------------------------------------------------------------
# Section: Unix File System
-------------------------------------------------------------------------------
No violations.
===============================================================================
Error Report:
===============================================================================
No Errors
-------------------------------------------------------------------------------
*** End of report ***
Open Source Tripwire 2.4 Portions copyright 2000 Tripwire, Inc. Tripwire is a registered
trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;
for details use --version. This is free software which may be redistributed
or modified only under certain conditions; see COPYING for details.
All rights reserved.
Integrity check complete.
|
最初は上記のように表示され何か変化があるとADD / MOVE / REMOVEに表示されるという仕組みです。もちろんいちいち手動でやるには面倒くさいのでcronにひっかけるのが王道的なやりかたです。
tripwire自体にメール送信機能はあるのですが、これを使うより結果をレポートするようなスクリプトを自作したほうが早そうです。デフォルトでは/etc/cron.dailyにtripwire-checkというファイルが生成されていますが、使い物にならなさそうです。
また、チェックのみの動作では仮にエラーがあった場合に延々とエラーとして検出されてしまいますのでチェック後にデーターベースを初期化する必要があります。( tripwire –init )