{"id":3104,"date":"2023-01-17T05:56:19","date_gmt":"2023-01-16T20:56:19","guid":{"rendered":"https:\/\/www.kinryo.net\/?p=3104"},"modified":"2025-06-03T07:22:25","modified_gmt":"2025-06-02T22:22:25","slug":"%ef%bc%94%ef%bc%9atripwire%e3%81%ae%e8%a8%ad%e5%ae%9a","status":"publish","type":"post","link":"https:\/\/www.kinryo.net\/?p=3104","title":{"rendered":"\uff14\uff1atripwire\u306e\u8a2d\u5b9a"},"content":{"rendered":"

\u5148\u305a\u306f\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3060\u304cEPEL\u3092\u6709\u52b9\u306b\u3057\u3066\u304a\u304f\u4e8b\uff08\u3053\u3053\u306e\u6700\u5f8c\u3092\u53c2\u7167\uff09<\/a>
\u53c2\u8003\uff08https:\/\/centossrv.com\/tripwire.shtml<\/a>\uff09
#<\/span> dnf -y install tripwire\u3000\u3000\u3000\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/span><\/span>
# <\/span>tripwire-setup-keyfiles<\/span>\u3000\u3000\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u6210
\u8868\u793a\u304c\u51fa\u305f\u5f8c
Enter the site keyfile passphrase:<\/span>\u3000\u3000\u3053\u3053\u3067\u81ea\u5206\u3067\u6c7a\u3081\u305f\u30b5\u30a4\u30c8PW\u3092\u5165\u529b
Verify the site keyfile passphrase:<\/span>\u3000\u3000\u518d\u5ea6\u5165\u529b
\u5c11\u3057\u3057\u3066
Enter the local keyfile passphrase:<\/span>\u3000\u3000\u3053\u3053\u3067\u81ea\u5206\u3067\u6c7a\u3081\u305f\u30ed\u30fc\u30ab\u30ebPW\u3092\u5165\u529b
Verify the local keyfile passphrase:<\/span>\u3000\u3000\u518d\u5ea6\u5165\u529b \u3059\u308b
\u5c11\u3057\u3057\u3066
Please enter your site passphrase:<\/span> \u3000\u3000
\u3068\u306a\u308b\u306e\u3067\u3001\u30b5\u30a4\u30c8PW\u3092\u5165\u529b \u518d\u5ea6\u805e\u3044\u3066\u304f\u308b\u3001
Please enter your site passphrase:<\/span> \u3000\u3000\u3068\u306a\u308b\u306e\u3067\u3001\u30b5\u30a4\u30c8PW\u3092\u5165\u529b \u3053\u308c\u3067\u7d42\u4e86
#<\/span> gedit \/etc\/tripwire\/twcfg.txt\u00a0<\/span>\u00a0 \u3000\u3000\u8a2d\u5b9a\u306e\u4fee\u6b63
ROOT =\/usr\/sbin<\/span>
POLFILE =\/etc\/tripwire\/tw.pol<\/span>
DBFILE =\/var\/lib\/tripwire\/$(HOSTNAME).twd<\/span>
REPORTFILE =\/var\/lib\/tripwire\/report\/$(HOSTNAME)-$(DATE).twr<\/span>
SITEKEYFILE =\/etc\/tripwire\/site.key<\/span>
LOCALKEYFILE =\/etc\/tripwire\/$(HOSTNAME)-local.key<\/span>
EDITOR =\/bin\/vi<\/span> LATEPROMPTING =false<\/span>
LOOSEDIRECTORYCHECKING =true<\/span>\u3000\u3000\u3000\u3000true\u306b\u5909\u66f4
MAILNOVIOLATIONS =true<\/span>
EMAILREPORTLEVEL =3<\/span>
REPORTLEVEL =4<\/span>\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u30004\u306b\u5909\u66f4
MAILMETHOD =SENDMAIL<\/span>
SYSLOGREPORTING =false<\/span>
MAILPROGRAM =\/usr\/sbin\/sendmail -oi -t<\/span>
\u3067\u4fdd\u5b58\u3057\u3066\u304a\u304f\u3001\u6b21\u306bTripwire\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb(\u6697\u53f7\u7f72\u540d\u7248)\u4f5c\u6210
#<\/span> twadmin -m F -c \/etc\/tripwire\/tw.cfg -S \/etc\/tripwire\/site.key \/etc\/tripwire\/twcfg.txt<\/span>
site passphrase\u3092\u805e\u3044\u3066\u304f\u308b\u306e\u3067\u5165\u529b\u3002\u305d\u306e\u5f8c\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u524a\u9664
#<\/span> rm -f \/etc\/tripwire\/twcfg.txt<\/span>
\u30dd\u30ea\u30b7\u30fc\u30d5\u30a1\u30a4\u30eb\u6700\u9069\u5316\u30b9\u30af\u30ea\u30d7\u30c8\u4f5c\u6210
# <\/span>gedit \/etc\/tripwire\/twpolmake.pl<\/span><\/p>\n

#!\/usr\/bin\/perl\n# Tripwire Policy File customize tool\n# ----------------------------------------------------------------\n# Copyright (C) 2003 Hiroaki Izumi\n# This program is free software; you can redistribute it and\/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\n# GNU General Public License for more details.\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.\n# ----------------------------------------------------------------\n# Usage:\n#    perl twpolmake.pl {Pol file}\n# ----------------------------------------------------------------\n#\n$POLFILE=$ARGV[0];\n\nopen(POL,\"$POLFILE\") or die \"open error: $POLFILE\" ;\nmy($myhost,$thost) ;\nmy($sharp,$tpath,$cond) ;\nmy($INRULE) = 0 ;\n\nwhile (<POL>) {\n    chomp;\n    if (($thost) = \/^HOSTNAME\\s*=\\s*(.*)\\s*;\/) {\n        $myhost = `hostname` ; chomp($myhost) ;\n        if ($thost ne $myhost) {\n            $_=\"HOSTNAME=\\\"$myhost\\\";\" ;\n        }\n    }\n    elsif ( \/^{\/ ) {\n        $INRULE=1 ;\n    }\n    elsif ( \/^}\/ ) {\n        $INRULE=0 ;\n    }\n    elsif ($INRULE == 1 and ($sharp,$tpath,$cond) = \/^(\\s*\\#?\\s*)(\\\/\\S+)\\b(\\s+->\\s+.+)$\/) {\n        $ret = ($sharp =~ s\/\\#\/\/g) ;\n        if ($tpath eq '\/sbin\/e2fsadm' ) {\n            $cond =~ s\/;\\s+(tune2fs.*)$\/; \\#$1\/ ;\n        }\n        if (! -s $tpath) {\n            $_ = \"$sharp#$tpath$cond\" if ($ret == 0) ;\n        }\n        else {\n            $_ = \"$sharp$tpath$cond\" ;\n        }\n    }\n    print \"$_\\n\" ;\n}\nclose(POL) ;<\/span><\/pre>\n
#<\/span> perl \/etc\/tripwire\/twpolmake.pl \/etc\/tripwire\/twpol.txt > \/etc\/tripwire\/twpol.txt.new<\/span>\u3000\u2190\u3000\u30dd\u30ea\u30b7\u30fc\u30d5\u30a1\u30a4\u30eb\u6700\u9069\u5316<\/span>
#<\/span> echo ! “\/var\/lib\/tripwire\/`hostname`.twd ;” >> \/etc\/tripwire\/twpol.txt.new<\/span>\u3000\u2190\u3000Tripwire\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u81ea\u4f53\u3092\u30c1\u30a7\u30c3\u30af\u5bfe\u8c61\u5916\u306b\u3059\u308b<\/span>
#<\/span> echo ! “\/tmp\/tripwire.log ;” >> \/etc\/tripwire\/twpol.txt.new<\/span>\u3000\u2190\u3000Tripwire\u30ed\u30b0\u3092\u30c1\u30a7\u30c3\u30af\u5bfe\u8c61\u5916\u306b\u3059\u308b<\/span>
<\/span>\u6700\u9069\u5316\u6e08\u30dd\u30ea\u30b7\u30fc\u30d5\u30a1\u30a4\u30eb\u3092\u5143\u306b\u30dd\u30ea\u30b7\u30fc\u30d5\u30a1\u30a4\u30eb(\u6697\u53f7\u7f72\u540d\u7248)\u4f5c\u6210
#<\/span> twadmin -m P -c \/etc\/tripwire\/tw.cfg -p \/etc\/tripwire\/tw.pol -S \/etc\/tripwire\/site.key \/etc\/tripwire\/twpol.txt.new<\/span>
site passphrase\u3092\u805e\u3044\u3066\u304f\u308b\u306e\u3067\u5165\u529b\u3002\u305d\u3057\u3066\u30dd\u30ea\u30b7\u30fc\u30d5\u30a1\u30a4\u30eb(\u30c6\u30ad\u30b9\u30c8\u7248)\u524a\u9664 
#<\/span> rm -f \/etc\/tripwire\/twpol.txt*<\/span> 
Tripwire\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u4f5c\u6210 
#<\/span> tripwire -m i -s -c \/etc\/tripwire\/tw.cfg<\/span> 
local passphrase\u3092\u805e\u3044\u3066\u304f\u308b\u306e\u3067\u5165\u529b \u3002\u5c11\u3057\u6642\u9593\u304c\u304b\u304b\u308b
Tripwire\u30c1\u30a7\u30c3\u30af\u5b9f\u884c 
#<\/span> tripwire -m c -s -c \/etc\/tripwire\/tw.cfg\u3000<\/span>\u3053\u308c\u3082\u5c11\u3057\u6642\u9593\u304c\u304b\u304b\u308b<\/p>\n
<\/p>\n
<\/p>\n
Open Source Tripwire(R) 2.4.3.7 Integrity Check Report\n\nReport generated by:          root\nReport created on:            2023\u5e7401\u670817\u65e5 05\u664240\u520621\u79d2\nDatabase last updated on:     Never\n\n=========================================================================\nReport Summary:\n=========================================================================\n\nHost name:                    kvm5.inpac.jp\nHost IP address:              133.149.213.105\nHost ID:                      None\nPolicy file used:             \/etc\/tripwire\/tw.pol\nConfiguration file used:      \/etc\/tripwire\/tw.cfg\nDatabase file used:           \/var\/lib\/tripwire\/kvm5.inpac.jp.twd\nCommand line used:            tripwire -m c -s -c \/etc\/tripwire\/tw.cfg \n\n=========================================================================\nRule Summary: \n=========================================================================\n\n-------------------------------------------------------------------------\n  Section: Unix File System\n-------------------------------------------------------------------------\n\n  Rule Name                   Severity Level    Added    Removed Modified \n  ---------                       --------------    -----    -------  ---\n  User binaries                   66                0        0        0        \n  Tripwire Binaries               100               0        0        0        \n  Libraries                       66                0        0        0        \n  Operating System Utilities      100               0        0        0        \n  File System and Disk Administraton Programs\n                                  100               0        0        0        \n  Kernel Administration Programs  100               0        0        0        \n  Networking Programs             100               0        0        0        \n  System Administration Programs  100               0        0        0        \n  Hardware and Device Control Programs\n                                  100               0        0        0        \n  System Information Programs     100               0        0        0        \n  (\/sbin\/runlevel)\n  Application Information Programs\n                                  100               0        0        0        \n  (\/sbin\/rtmon)\n  Critical Utility Sym-Links      100               0        0        0        \n  Shell Binaries                  100               0        0        0        \n  Critical system boot files      100               0        0        0        \n* Tripwire Data Files             100               1        0        0        \n  System boot changes             100               0        0        0        \n  OS executables and libraries    100               0        0        0        \n  Security Control                100               0        0        0        \n  Login Scripts                   100               0        0        0        \n  Critical configuration files    100               0        0        0        \n* Root config files               100               0        0        1        \n  Invariant Directories           66                0        0        0        \n  Temporary directories           33                0        0        0        \n  Critical devices                100               0        0        0        \n  (\/proc\/kcore)\n\nTotal objects scanned:  44064\nTotal violations found:  2\n\n=========================================================================\nObject Summary: \n=========================================================================\n# Section: Unix File System\n-------------------------------------------------------------------------\n\n-------------------------------------------------------------------------\nRule Name: Tripwire Data Files (\/var\/lib\/tripwire)\nSeverity Level: 100\n-------------------------------------------------------------------------\n\nAdded:\n\"\/var\/lib\/tripwire\/kvm5.inpac.jp.twd\"\n\n-------------------------------------------------------------------------\nRule Name: Root config files (\/root)\nSeverity Level: 100\n-------------------------------------------------------------------------\n\nModified:\n\"\/root\/.local\/share\/gnome-shell\/application_state\"\n\n=========================================================================\nError Report: \n=========================================================================\n\nNo Errors\n\n-------------------------------------------------------------------------\n*** End of report ***\n\nOpen Source Tripwire 2.4 Portions copyright 2000-2018 Tripwire, Inc.  Tripwire is a registered\ntrademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;\nfor details use --version. This is free software which may be redistributed\nor modified only under certain conditions; see COPYING for details.\nAll rights reserved.<\/span><\/code><\/pre>\n
<\/p>\n
\u3042\u308b\u4e00\u5b9a\u306e\u6642\u9593\u3092\u904e\u304e\u305f\u30d5\u30a1\u30a4\u30eb\u3084\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3092\u524a\u9664\u3057\u305f\u3044\u6642\u306a\u3069\u306b tmpwatch \u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b
#<\/span> dnf install tmpwatch<\/span>
\u305d\u3057\u3066\u3001tripwire\u3092\u5b9a\u671f\u7684\u306b\u8d70\u3089\u305b\u308b\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u4f5c\u6210\u3059\u308b
#<\/span> gedit tripwire.sh<\/span><\/span><\/span><\/span><\/span><\/p>\n
<\/p>\n
#!\/bin\/bash

# \u65e2\u5b58\u306eTripwire\u5b9a\u671f\u81ea\u52d5\u5b9f\u884c\u8a2d\u5b9a\u524a\u9664
rm -f \/etc\/cron.daily\/tripwire-check

# \u30d1\u30b9\u30d5\u30ec\u30fc\u30ba\u8a2d\u5b9a
LOCALPASS=xxxxxxx\u00a0\u00a0\u00a0 # \u30ed\u30fc\u30ab\u30eb\u30d1\u30b9\u30d5\u30ec\u30fc\u30ba
SITEPASS=xxxxxxxx\u00a0\u00a0\u00a0\u00a0\u00a0 # \u30b5\u30a4\u30c8\u30d1\u30b9\u30d5\u30ec\u30fc\u30ba

TRIPWIRE=\/usr\/sbin\/tripwire
TWADMIN=\/usr\/sbin\/twadmin
TWPRINT=\/usr\/sbin\/twprint
cd \/etc\/tripwire

# Tripwire\u30c1\u30a7\u30c3\u30af\u5b9f\u884c
# \u203b\u30d5\u30a1\u30a4\u30eb\u5909\u66f4\u3092\u691c\u77e5\u3057\u305f\u5834\u5408\u306e\u307froot\u5b9b\u306b\u30b5\u30de\u30ea\u3092\u30e1\u30fc\u30eb\u3059\u308b
rm -f \/var\/lib\/tripwire\/report\/`hostname`-`date +%Y%m%d`-*.twr
${TRIPWIRE} -m c -s -c tw.cfg > \/tmp\/tripwire.log
if [ $(grep \"Total violations found\" \/tmp\/tripwire.log | awk '{print $4}') -ne 0 ]; then
${TWPRINT} -m r --report-level 1 -c tw.cfg -r \/var\/lib\/tripwire\/report\/`hostname`-`date +%Y%m%d`-*.twr | \\
mail -s \"Tripwire Integrity Check Report from `hostname`\" root
fi

# Tripwire\u30c1\u30a7\u30c3\u30af\u5b9f\u884c\u7d50\u679c\uff08\u904e\u53bb\u5206\uff09\u524a\u9664
# \u203b\u904e\u53bb90\u65e5\u5206\u4fdd\u7ba1
tmpwatch -m 2160 \/var\/lib\/tripwire\/report

# \u30dd\u30ea\u30b7\u30fc\u30d5\u30a1\u30a4\u30eb\u6700\u65b0\u5316
${TWADMIN} -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt
perl twpolmake.pl twpol.txt > twpol.txt.new
${TWADMIN} -m P -c tw.cfg -p tw.pol -S site.key -Q $SITEPASS twpol.txt.new > \/dev\/null
rm -f twpol.txt* *.bak

# \u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u6700\u65b0\u5316
rm -f \/var\/lib\/tripwire\/*.twd*
${TRIPWIRE} -m i -s -c tw.cfg -P $LOCALPASS<\/pre>\n
<\/p>\n\n\n
\u3053\u308c\u3092 \/root\u306b\u4fdd\u5b58\u3057\u3001\/etc\/cron.d \u306b tripwire.sh \u3092\u5b9a\u6642\u306b\u8d70\u3089\u305b\u308b\u8a2d\u5b9a\u3092\u4f5c\u308b\u3002
# echo “15 4 * * * root \/root\/tripwire.sh” > \/etc\/cron.d\/tripwire
\u3053\u308c\u3067\u6bce\u65e54\u664215\u5206\u306b tripwire.sh\u304c\u52d5\u304d\u3001\u30d5\u30a1\u30a4\u30eb\u306e\u5909\u66f4\u304c\u3042\u3063\u305f\u6642\u306b\u30e1\u30fc\u30eb\u304c\u9001\u3089\u308c\u3066\u304f\u308b(\u3068\u8a00\u3063\u3066\u3082\u6bce\u65e5\u4f55\u3089\u304b\u306e\u5909\u66f4\u304c\u3042\u308b\u306e\u3067(log\u7b49)\u6bce\u65e5\u9001\u3089\u308c\u3066\u6765\u308b\u304c\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
\u5148\u305a\u306f\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3060\u304cEPEL\u3092\u6709\u52b9\u306b\u3057\u3066\u304a\u304f\u4e8b\uff08\u3053\u3053\u306e\u6700\u5f8c\u3092\u53c2\u7167\uff09 \u53c2\u8003\uff08https:\/\/centossrv.com\/tripwire.shtml\uff09 # dnf -y install tripwire\u3000\u3000\u3000\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb … \u7d9a\u304d\u3092\u8aad\u3080 →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"vkexunit_cta_each_option":"","footnotes":""},"categories":[27],"tags":[],"class_list":["post-3104","post","type-post","status-publish","format-standard","hentry","category-almalinux"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.kinryo.net\/index.php?rest_route=\/wp\/v2\/posts\/3104","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kinryo.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kinryo.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kinryo.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kinryo.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3104"}],"version-history":[{"count":16,"href":"https:\/\/www.kinryo.net\/index.php?rest_route=\/wp\/v2\/posts\/3104\/revisions"}],"predecessor-version":[{"id":4299,"href":"https:\/\/www.kinryo.net\/index.php?rest_route=\/wp\/v2\/posts\/3104\/revisions\/4299"}],"wp:attachment":[{"href":"https:\/\/www.kinryo.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3104"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kinryo.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3104"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kinryo.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3104"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}