Tripwire and alternatives

I'm wondering if anybody could guide me here. I have 3 dedicated linux servers and want to install tripwire in order to track changes in the key files/folders in the filesystem

Initial research has shown me that there is no 64-bit version for this (my servers are 64-bit) except the commercial version of tripwire which comes with a heavy cost.

Are there any other good alternatives to tripwire's commercial version that can deliver similar or better functionality (free or not)?

Thanks,

Mark.

-

migrated from stackoverflow.comSep 4 '09 at 17:47

This question came from our site for professional and enthusiast programmers.

The best alternative is AIDE. You should be able to install the 64bit version using your package manager as its in most distros - CentOS has v0.13.1 in the base repository.

As it says:

AIDE (Advanced Intrusion Detection Environment) is a free replacement for Tripwire. It does the same things as the semi-free Tripwire and more.

There are other free replacements available so why build a new one? All the other replacements do not achieve the level of Tripwire. And I wanted a program that would exceed the limitations of Tripwire.

-
Thanks for getting back to me. I actually already have AIDE installed, but I believe it does not encrypt it's database like tripwire does. The problem I can see with both AIDE and free trip wire however is that they both produce reports in "raw" format and you need some level of unix server administrative technical expertise to analyse the reports which I do not have. Are there applications that can provide a more userfriendly analysis w'out compromising the level of detail that tripwire/aide provide? I suppose I am tryin to figure out if it is worth me spending the money on non-free twire! –  Mark Blades Sep 4 '09 at 12:07
encryption isn't all its cracked up to be - you run AIDE as a particular user, and only that user gets access to the file. If an attacker gets root to view it, you have problems anyway - an attacker could replace the tripwire binary with something that says "no problems" and you'd never know, or just delete the tripwire DB. So always run AIDE first, and keep its DB on a read-only medium (eg a CDROM). Once set up and tweaked, you should not really get any results in the logs - use it mainly for system file changes, not expected user ones. see securityfocus.com/infocus/1424. –  gbjbaanb Sep 4 '09 at 17:27

You might have a look at fcheck. It's rather old, but i like its status report: Here's a sample report:

PROGRESS: validating integrity of /usr/lib/
STATUS:passed...

PROGRESS: validating integrity of /root/
STATUS:
WARNING: [hostname] /root/.bash_history
[Sizes: 13769 - 14445, Times: Jul 01 11:56 2010 - Jul 01 14:48 2010, CRCs: c298c20f5c2a594c3dc9a1bfa517192c - 197d2284d1182505bc357a505af72472]

-

You said that you want to "track changes in the key files/folders in the filesystem".

Why? What's the end goal? Are you doing this for security or some other reason? What type of granularity do you need?

Many backup systems like Bacula will take checksums of files and compare them on whatever schedule the system runs...

-