Phoenix Network Forums

First off, does anyone use any type of tripwire software? If so, which one? If not, is it not that important to you, had a bad experience, or never heard of it? For those that have used one, what are some examples of false alarms, if any, that you have encountered and what are some examples of where it really helped?

Apple recently issued an os update and I had a file that failed a tripwire scan after the update. I'm pretty sure it is because of the update but not 100%. I used

Code: Select all

find . -mtime 4

and found that the file was modified around the same time as the update.

Does anyone know of a better way to check the modified file to verify who caused the change?

safety wrote:First off, does anyone use any type of tripwire software? If so, which one? If not, is it not that important to you, had a bad experience, or never heard of it? For those that have used one, what are some examples of false alarms, if any, that you have encountered and what are some examples of where it really helped?

What kind of tripwire do you mean? I could think of many kinds of tripwires: for software, files, network activity or even physical tripwires like noise detection and motion detection.

safety wrote:Apple recently issued an os update and I had a file that failed a tripwire scan after the update. I'm pretty sure it is because of the update but not 100%. I used

Code: Select all

find . -mtime 4

and found that the file was modified around the same time as the update.

Does anyone know of a better way to check the modified file to verify who caused the change?

Yes, but you need to have done that much earlier. After installing that system, while it's in a trustworthy state, you have to collect checksums of those files. You can use sha1sum or md5sum for that purpose, with the former command being preferred. Don't create checksums of your entire filesystem, but only of binaries and configuration files. Example command:

Code: Select all

sha1sum $(find /bin -type f) $(find /usr/bin -type f) $(find /etc -type f) $(find ...) > checksums

There are more directories you should take into account, most notably /sbin and /usr/sbin.

After that, copy the checksums file to a CD-ROM or floppy disk. A reasonable but optional step would be to sign this file with your GPG key:

Code: Select all

gpg -as checksums

If you have signed the file, then save the resulting file checksums.asc, otherwise save the plaintext file checksums.

To verify the filesystem all you have to do is to get that floppy disk or CD-ROM back and use the file with the checksums. If it's in plaintext, then just do:

Code: Select all

sha1sum -c checksums

Otherwise do:

Code: Select all

gpg --decrypt checksums.asc | sha1sum -c

If there are any damaged/modified files, then sha1sum will notify you . Then either somebody has messed around with the checksums file (in case it was signed), or some file on your filesystem has been changed.

However, it's not easy to know, who has done the damage. It may well come from updates. You must run this check before each update, and then regenerate the checksums after the update. I strongly suggest to do the update offline. In case of floppy disk, set the disk read-only all the time, unless you are regenerating the checksums.

I am using a software tripwire called checkmate. I've had it installed for about a month with the original md5 checksums. I've set the program to run everyday and give me a report on findings. That's how I knew a file had been altered. You have given me some good advice, thanks!

The file that was altered was /usr/sbin/named. I've used netstat -an to make sure that port 53 was not listening for any connections. No other files were altered only this one. What are your thoughts?

I use OS X.
No, I have never used this file.
Yes, the update was done Monday.

It might well be that the system update has modified your named binary.

I perfer ftimes for system integrity checking.. it is as complex as you want.

http://ftimes.sourceforge.net/FTimes/

below is the traditional tripwire opensource that has been muddled with for awhile.. but I did find this. on MAC OSX darwin.

http://www.macguru.net/~frodo/Tripwire-osx.html#Downloads