I have a ubuntu server with weekly auto update/upgrade and tripwire installed.

The problem is that the auto update kind of makes tripwire useless as changes always occur on my server. Therefore I constantly have violations flagged by tripwire.

If there were any malicious changes I would miss them.

What is the best practice in such a situation? Is there a way to have automatic updates and useful tripwire reports? How do people usually combine the two?


I haven't used tripwire in ages but conceptually:

You could choose to limit the tripwire report to alert/report only on missing and newly created files in the */bin/, */sbin/ and */lib/ directories rather than comparing the checksums of the files in those directories.

You then use the package manager to report on the integrity of the packages as explained in for instance this question which should detect when binaries have been replaced or when the package manager has been used to replace existing packages with untrusted packages.

Admittedly it appears that the RPM format is a bit stronger in requiring signed packages although this article explains how to enforce and verify signed packages on Debian and Ubuntu.

  • So what is the best practice? Having automatic updates or using a IDS like Tripwire. How do people usually combine the two? – Cyrus Jan 9 '15 at 7:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.