Tripwire is a free software security and data integrity tool useful for monitoring and alerting on specific file change(s) on a range of systems.

learn more… | top users | synonyms

0
votes
0answers
15 views

Tripwire security

I have installed Tripwire on a temporary server to get a feel for it. Everything seems to be working (e.g. it detects changes and sends an email report). If I understand Tripwire correctly it is ...
1
vote
1answer
46 views

remove postfix without removing tripwire (Ubuntu 15.10)

I installed tripwire and by mistake asked it to install postfix. How can I remove postfix and not lose tripwire? root@blah:~# apt-get remove postfix Reading package lists... Done Building ...
0
votes
1answer
130 views

Too Many HTTP Requests from one source

We are having an issue at one of our customer sites where Tripwire is flagging events when more than 1000 HTTP connections are being individually created from different IP addresses within a span of ...
1
vote
1answer
32 views

Investigating Tripwire report - 172 files added to “/proc/sys/net/” [closed]

Tripwire reported 172 files added to various sub-folders at "/proc/sys/net/ipv4" and "/proc/sys/net/ipv6". How can i investigate this? I'm running an Ubuntu 14 vps.
1
vote
1answer
88 views

Server auto update with tripwire IDS

I have a ubuntu server with weekly auto update/upgrade and tripwire installed. The problem is that the auto update kind of makes tripwire useless as changes always occur on my server. Therefore I ...
0
votes
0answers
42 views

Tripwire taking forever to accept report (Tripwire not accepting report)

I have a problem It's been a while since I ran Tripwire. (One Year) I'm able to make a report. (Takes about 1h30) But when I run the command to accept the file, it just runs and runs and runs, ...
0
votes
0answers
203 views

Tripwire unable to send mail

I'm installing Tripwire Enterprise Console (Server) onto a windows server that happens to be an SMTP forwarder. I proceed through the steps to install TEC and it completes not reporting any errors. ...
1
vote
1answer
92 views

Tripwire help Required

I have created the policy file in Tripwire and also I have created the rules as well mentioned below: /opt/jboss/server/gis/conf -> $(SEC_CONFIG) +aipm +c+g+a+i+s+t+u+l+M; ...
1
vote
3answers
768 views

Simple application level file integrity monitoring & Intrusion detection (IDS)

We've been searching for a simple file integrity monitoring solution on CentOS/Linux that will work on the application level. We are not looking for OS/network level IDS as OSSEC and the others do a ...
0
votes
1answer
235 views

Building Tripwire RPM on CentOS6

I have been unable to locate a pre-built RPM for Tripwire on CentOS6. I have tried installing the one from CentOS5, as well as a couple of later Fedora RPMs, but all fail on a dependency on ...
1
vote
1answer
382 views

Tripwire reporting a changed /dev/char

This was in a recent Tripwire report of a Debian Linux (virtual) server: ### Attr Observed (what it is) Expected (what it should be) ### =========== ============================= ...
3
votes
2answers
1k views

Should tripwire be entering /proc?

When initializing the db with tripwire --init it spat out a bunch of errors pertaining to /proc: ### Warning: File system error. ### Filename: /proc/16982/fd/4 ### No such file or directory ### ...
2
votes
1answer
905 views

Tripwire: tripwire --update -Z low says Error: File could not be opened

When i scan my system with tripwire and try to update after with tripwire --update -Z low i get the error: ### Error: File could not be opened. ### Filename: ...
7
votes
5answers
2k views

Web Server Security Overkill?

I've been doing "extensive" research on securing a linux web server. On top of what is considered the "basics" (removing unused services, hardening ssh, iptables, etc.) is it wise to include ...
2
votes
3answers
2k views

For tripwire, how would I have the report e-mailed only when a violation is found

My ideal solution for tripwire reports would be: Daily e-mails would only generate if a violation was found Every Sunday, a report would be e-mailed regardless of whether a violation was found I'm ...
2
votes
2answers
4k views

How do I send mail from Tripwire using SMTP?

I have just installed tripwire using Ubuntu repos and have gone into the configuration files and changed everything to what I want. When in comes to the options for SMTP mail method and the server and ...
6
votes
3answers
2k views

Tripwire policy suggestions

I've setup tripwire on a debian server, and default policy had some strange settings. # # Critical devices # ( rulename = "Devices & Kernel information", severity = $(SIG_HI), ) { /dev ...