Introduction to Tripwire

The Tripwire package contains the programs used by Tripwire to verify the integrity of the files on a given system.

Package information

Additional downloads

Shadow dependencies

Installation of Tripwire

Compile Tripwire by running the following commands:

patch -Np1 -i ../tripwire-2.3.1-2-gcc3-build-fixes.patch &&
make -C src release &&
cp install/install.{sh,cfg} .

The default configuration is to use a local MTA. If you don't have a MTA installed and have no wish to install one, modify the install.cfg to use an SMTP server instead. Install Tripwire by running the following commands:

./ &&
cp /etc/tripwire/tw.cfg /usr/sbin &&
cp policy/*.txt /usr/share/doc/tripwire

Command explanations

make release: This command creates the Tripwire binaries.

cp install.{sh,cfg} .: These are copied to the main Tripwire directory so that the script can be used to install the package.

cp policy/*.txt /usr/share/doc/tripwire: This command installs the documentation.

Configuring Tripwire

Config files


Configuration Information

Tripwire uses a policy file to determine which files integrity are checked. The default policy file (twpol.txt found in /etc/tripwire/) is for a default installation of Redhat 7.0 and is woefully outdated.

Policy files are also a custom thing and should be tailored to each individual distribution and/or installation. Some custom policy files can be found below:
Checks integrity of all files
Custom policy file for Base LFS 3.0 system
Custom policy file for SuSE 7.2 system

Download the custom policy file you'd like to try, copy it into /etc/tripwire/, and use it instead of twpol.txt. It is, however, recommended that you make your own policy file. Get ideas from the examples above and read /usr/share/doc/tripwire/policyguide.txt. twpol.txt is a good policy file for beginners as it will note any changes to the file system and can even be used as an annoying way of keeping track of changes for uninstallation of software.

After your policy file has been transferred to /etc/tripwire/ you may begin the configuration steps:

twadmin -m P /etc/tripwire/twpol.txt &&
tripwire -m i

During installation Tripwire will create two (2) keys: a site key and a local key which will be stored in /etc/tripwire/.

Usage Information

To use Tripwire after this and run a report, use the following command:

tripwire -m c > /etc/tripwire/report.txt

View the output to check the integrity of your files. An automatic integrity report can be produced by using a cron facility to schedule the runs.

Please note that after you run an integrity check, you must check the report or email and then modify the Tripwire database of the files on your system so that Tripwire will not continually notify you that files you intentionally changed are a security violation. To do this you must first ls -l /var/lib/tripwire/report/ and note the name of the newest file which starts with linux- and ends in .twr. This encrypted file was created during the last report creation and is needed to update the Tripwire database of your system. Then, type in the following command making the appropriate substitutions for '?':

tripwire -m u -r /var/lib/tripwire/report/linux-???????-??????.twr 

You will be placed into vim with a copy of the report in front of you. If all the changes were good, then just type :x and after entering your local key, the database will be updated. If there are files which you still want to be warned about, please remove the x before the filename in the report and type :x.

Changing the Policy File

If you are unhappy with your policy file and would like to modify it or use a new one, modify the policy file and then execute the following commands:

twadmin -m P /etc/tripwire/twpol.txt &&
tripwire -m i


The Tripwire package contains siggen , tripwire, twadmin and twprint.