Tripwire – Intrusion Detection System (IDS)

O programa tripwire é um programa de IDS – Intrusion Detection System. Sua ideia conceitalmente é simples, ele guarda uma assinatura de diversos arquivos importantes do sistema operacional (não todos, pode ficar tranquilo que ele não irá verificar seus DATAFILEs), e se algum for alterado (o que acontece muito em estágios iniciais de ataques), removido ou adicionado, o tripwire irá informar em seu relatório de verificação.

O primeiro passo é a instalação (que requer o reposítório EPEL). Os procedimentos abaixo foram feitos em CentOS 7.3.

[root@Gaspar ~]# yum -y install epel-release
Loaded plugins: fastestmirror, langpacks
Loading mirror speeds from cached hostfile
 * base: mirror.ufscar.br
 * epel: mirror.us.leaseweb.net
 * extras: mirror.ufscar.br
 * updates: mirror.ufscar.br
Package epel-release-7-10.noarch already installed and latest version
Nothing to do
[root@Gaspar ~]# yum -y install tripwire
Loaded plugins: fastestmirror, langpacks
Loading mirror speeds from cached hostfile
 * base: mirror.ufscar.br
 * epel: mirror.us.leaseweb.net
 * extras: mirror.ufscar.br
 * updates: mirror.ufscar.br
Resolving Dependencies
--> Running transaction check
---> Package tripwire.x86_64 0:2.4.3.5-1.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

========================================================================================================================================================================
 Package                                 Arch                                  Version                                        Repository                           Size
========================================================================================================================================================================
Installing:
 tripwire                                x86_64                                2.4.3.5-1.el7                                  epel                                1.0 M

Transaction Summary
========================================================================================================================================================================
Install  1 Package

Total download size: 1.0 M
Installed size: 4.2 M
Downloading packages:
tripwire-2.4.3.5-1.el7.x86_64.rpm                                                                                                                | 1.0 MB  00:00:06
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : tripwire-2.4.3.5-1.el7.x86_64                                                                                                                        1/1
  Verifying  : tripwire-2.4.3.5-1.el7.x86_64                                                                                                                        1/1

Installed:
  tripwire.x86_64 0:2.4.3.5-1.el7

Complete!
[root@Gaspar ~]#

Em seguida é necessário executar os procedimentos de criação das chaves e da criação do banco de dados dos arquivos protegidos.

Não ligue para as mensagens “Warning: File system error” e “No such file or directory” – são arquivos monitorados por padrão pelo tripwire, mas que seu sistema não tem instalado. Estes arquivos poderiam ser removidos da política de verificação, mas eu prefiro deixa-los, caso algum destes programas seja instalado no futuro.

[root@Gaspar ~]# tripwire-setup-keyfiles

----------------------------------------------
The Tripwire site and local passphrases are used to sign a  variety  of
files, such as the configuration, policy, and database files.

Passphrases should be at least 8 characters in length and contain  both
letters and numbers.

See the Tripwire manual for more information.

----------------------------------------------
Creating key files...

(When selecting a passphrase, keep in mind that good passphrases typically
have upper and lower case letters, digits and punctuation marks, and are
at least 8 characters in length.)

Enter the site keyfile passphrase:
Verify the site keyfile passphrase:
Generating key (this may take several minutes)...Key generation complete.

(When selecting a passphrase, keep in mind that good passphrases typically
have upper and lower case letters, digits and punctuation marks, and are
at least 8 characters in length.)

Enter the local keyfile passphrase:
Verify the local keyfile passphrase:
Generating key (this may take several minutes)...Key generation complete.

----------------------------------------------
Signing configuration file...
Please enter your site passphrase:
Wrote configuration file: /etc/tripwire/tw.cfg

A clear-text version of the Tripwire configuration file:
/etc/tripwire/twcfg.txt
has been preserved for your inspection.  It  is  recommended  that  you
move this file to a secure location and/or encrypt it in place (using a
tool such as GPG, for example) after you have examined it.


----------------------------------------------
Signing policy file...
Please enter your site passphrase:
Wrote policy file: /etc/tripwire/tw.pol

A clear-text version of the Tripwire policy file:
/etc/tripwire/twpol.txt
has been preserved for  your  inspection.  This  implements  a  minimal
policy, intended only to test  essential  Tripwire  functionality.  You
should edit the policy file to  describe  your  system,  and  then  use
twadmin to generate a new signed copy of the Tripwire policy.

Once you have a satisfactory Tripwire policy file, you should move  the
clear-text version to a secure location  and/or  encrypt  it  in  place
(using a tool such as GPG, for example).

Now run "tripwire --init" to enter Database Initialization  Mode.  This
reads the policy file, generates a database based on its contents,  and
then cryptographically signs the resulting  database.  Options  can  be
entered on the command line to specify which policy, configuration, and
key files are used  to  create  the  database.  The  filename  for  the
database can be specified as well. If no  options  are  specified,  the
default values from the current configuration file are used.

[root@Gaspar ~]# tripwire --init
Please enter your local passphrase:
Parsing policy file: /etc/tripwire/tw.pol
Generating the database...
*** Processing Unix File System ***
### Warning: File system error.
### Filename: /usr/sbin/fixrmtab
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /usr/share/grub/i386-redhat/e2fs_stage1_5
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /usr/share/grub/i386-redhat/fat_stage1_5
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /usr/share/grub/i386-redhat/ffs_stage1_5
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /usr/share/grub/i386-redhat/minix_stage1_5
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /usr/share/grub/i386-redhat/reiserfs_stage1_5
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /usr/share/grub/i386-redhat/stage1
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /usr/share/grub/i386-redhat/stage2
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /usr/share/grub/i386-redhat/vstafs_stage1_5
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/busybox
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/busybox.anaconda
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/debugreiserfs
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/dump
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/dump.static
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ftl_check
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ftl_format
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/hdparm
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mkbootdisk
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mkinitrd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mkraid
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mkreiserfs
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/pcinitrd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/raidstart
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/reiserfsck
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/resize_reiserfs
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/restore
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/restore.static
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/scsi_info
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/stinit
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/unpack
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/adjtimex
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/insmod.static
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/insmod_ksymoops_clean
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/klogd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/minilogd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/sndconfig
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ifport
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ifuser
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ipx_configure
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ipx_interface
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ipx_internal_net
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/iwconfig
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/iwgetid
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/iwlist
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/iwpriv
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/iwspy
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mgetty
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mingetty
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/portmap
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/vgetty
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ypbind
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/initlog
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/pam_tally
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/pwdb_chkpwd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/rescuept
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/rmt
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/rpc.lockd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/setsysfont
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/syslogd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/cardctl
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/cardmgr
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/dump_cis
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/elvtune
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/hotplug
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ide_info
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/lspnp
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/pack_cis
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/probe
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/shapecfg
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/kernelversion
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/genksyms
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/getkey
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/nash
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/sash
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/fsck.reiserfs
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/kallsyms
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ksyms
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mkfs.reiserfs
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mount.ncp
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mount.ncpfs
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mount.smb
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mount.smbfs
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/raid0run
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/raidhotadd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/raidhotremove
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/raidstop
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/rdump
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/rdump.static
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/rrestore
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/rrestore.static
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/grub
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/grub-install
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/grub-md5-crypt
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/lilo
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mkkerneldoth
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/iptables
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/portmap
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/apmd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/atd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/canna
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/crond
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/gpm
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/kudzu
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/netfs
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/nfslock
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/ntpd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/random
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/sendmail
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/sshd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/syslog
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/xfs
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/xinetd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /etc/sysconfig/network-scripts/ifdown-cipcb
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /etc/sysconfig/network-scripts/ifdown-sl
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /etc/sysconfig/network-scripts/ifup-cipcb
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /etc/sysconfig/network-scripts/ifup-sl
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /etc/modules.conf
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /etc/named.conf
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /etc/yp.conf
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /etc/xinetd.conf
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /etc/syslog.conf
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/sfxload
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/ash
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/ash.static
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/aumix-minimal
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/doexec
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/mt
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/zsh
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/bash2
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/bsh
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/ksh
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /root/.Xresources
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /root/.esd_auth
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /root/.gnome
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /root/.ICEauthority
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /root/.Xauthority
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /dev/cua0
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /dev/kmem
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /proc/ksyms
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /proc/pci
### No such file or directory
### Continuing...
Wrote database file: /var/lib/tripwire/Gaspar.localdomain.twd
The database was successfully generated.
[root@Gaspar ~]#

E agora a verificação em si, que deve ser agendada e monitorada regularmente. O ponto onde você deve focar é em “Total violations found”, na seção “Rule Summary”. Veja que um arquivo alterado foi justamente do tripwire, já que ele teve seu banco de dados inicializado.

[root@Gaspar ~]# tripwire --check
Parsing policy file: /etc/tripwire/tw.pol
*** Processing Unix File System ***
Performing integrity check...
### Warning: File system error.
### Filename: /usr/sbin/fixrmtab
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /usr/share/grub/i386-redhat/e2fs_stage1_5
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /usr/share/grub/i386-redhat/fat_stage1_5
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /usr/share/grub/i386-redhat/ffs_stage1_5
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /usr/share/grub/i386-redhat/minix_stage1_5
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /usr/share/grub/i386-redhat/reiserfs_stage1_5
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /usr/share/grub/i386-redhat/stage1
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /usr/share/grub/i386-redhat/stage2
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /usr/share/grub/i386-redhat/vstafs_stage1_5
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/busybox
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/busybox.anaconda
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/debugreiserfs
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/dump
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/dump.static
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ftl_check
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ftl_format
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/hdparm
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mkbootdisk
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mkinitrd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mkraid
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mkreiserfs
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/pcinitrd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/raidstart
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/reiserfsck
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/resize_reiserfs
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/restore
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/restore.static
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/scsi_info
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/stinit
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/unpack
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/adjtimex
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/insmod.static
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/insmod_ksymoops_clean
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/klogd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/minilogd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/sndconfig
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ifport
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ifuser
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ipx_configure
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ipx_interface
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ipx_internal_net
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/iwconfig
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/iwgetid
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/iwlist
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/iwpriv
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/iwspy
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mgetty
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mingetty
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/portmap
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/vgetty
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ypbind
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/initlog
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/pam_tally
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/pwdb_chkpwd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/rescuept
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/rmt
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/rpc.lockd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/setsysfont
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/syslogd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/cardctl
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/cardmgr
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/dump_cis
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/elvtune
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/hotplug
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ide_info
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/lspnp
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/pack_cis
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/probe
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/shapecfg
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/kernelversion
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/genksyms
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/getkey
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/nash
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/sash
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/fsck.reiserfs
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/kallsyms
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/ksyms
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mkfs.reiserfs
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mount.ncp
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mount.ncpfs
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mount.smb
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mount.smbfs
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/raid0run
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/raidhotadd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/raidhotremove
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/raidstop
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/rdump
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/rdump.static
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/rrestore
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/rrestore.static
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/grub
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/grub-install
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/grub-md5-crypt
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/lilo
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /sbin/mkkerneldoth
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/iptables
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/portmap
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/apmd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/atd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/canna
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/crond
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/gpm
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/kudzu
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/netfs
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/nfslock
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/ntpd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/random
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/sendmail
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/sshd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/syslog
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/xfs
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /var/lock/subsys/xinetd
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /etc/sysconfig/network-scripts/ifdown-cipcb
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /etc/sysconfig/network-scripts/ifdown-sl
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /etc/sysconfig/network-scripts/ifup-cipcb
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /etc/sysconfig/network-scripts/ifup-sl
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /etc/modules.conf
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /etc/named.conf
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /etc/yp.conf
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /etc/xinetd.conf
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /etc/syslog.conf
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/sfxload
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/ash
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/ash.static
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/aumix-minimal
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/doexec
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/mt
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/zsh
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/bash2
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/bsh
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/ksh
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /dev/cua0
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /root/.Xresources
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /root/.esd_auth
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /root/.gnome
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /root/.ICEauthority
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /root/.Xauthority
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /dev/kmem
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /proc/ksyms
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /proc/pci
### No such file or directory
### Continuing...
Wrote report file: /var/lib/tripwire/report/Gaspar.localdomain-20170718-155045.twr


Open Source Tripwire(R) 2.4.3.5 Integrity Check Report

Report generated by:          root
Report created on:            Tue 18 Jul 2017 03:50:45 PM -03
Database last updated on:     Never

===============================================================================
Report Summary:
===============================================================================

Host name:                    Gaspar.localdomain
Host IP address:              192.168.15.10
Host ID:                      None
Policy file used:             /etc/tripwire/tw.pol
Configuration file used:      /etc/tripwire/tw.cfg
Database file used:           /var/lib/tripwire/Gaspar.localdomain.twd
Command line used:            tripwire --check

===============================================================================
Rule Summary:
===============================================================================

-------------------------------------------------------------------------------
  Section: Unix File System
-------------------------------------------------------------------------------

  Rule Name                       Severity Level    Added    Removed  Modified
  ---------                       --------------    -----    -------  --------
  User binaries                   66                0        0        0
  Tripwire Binaries               100               0        0        0
  Critical configuration files    100               0        0        0
  Libraries                       66                0        0        0
  Operating System Utilities      100               0        0        0
  Critical system boot files      100               0        0        0
  File System and Disk Administraton Programs
                                  100               0        0        0
  Kernel Administration Programs  100               0        0        0
  Networking Programs             100               0        0        0
  System Administration Programs  100               0        0        0
  Hardware and Device Control Programs
                                  100               0        0        0
  System Information Programs     100               0        0        0
  Application Information Programs
                                  100               0        0        0
  Shell Related Programs          100               0        0        0
  Critical Utility Sym-Links      100               0        0        0
  Shell Binaries                  100               0        0        0
* Tripwire Data Files             100               1        0        0
  System boot changes             100               0        0        0
  OS executables and libraries    100               0        0        0
  Security Control                100               0        0        0
  Login Scripts                   100               0        0        0
  Root config files               100               0        0        0
  Invariant Directories           66                0        0        0
  Temporary directories           33                0        0        0
  Critical devices                100               0        0        0

Total objects scanned:  44525
Total violations found:  1

===============================================================================
Object Summary:
===============================================================================

-------------------------------------------------------------------------------
# Section: Unix File System
-------------------------------------------------------------------------------

-------------------------------------------------------------------------------
Rule Name: Tripwire Data Files (/var/lib/tripwire)
Severity Level: 100
-------------------------------------------------------------------------------

Added:
"/var/lib/tripwire/Gaspar.localdomain.twd"

===============================================================================
Error Report:
===============================================================================

-------------------------------------------------------------------------------
  Section: Unix File System
-------------------------------------------------------------------------------

1.   File system error.
     Filename: /usr/sbin/fixrmtab
     No such file or directory
2.   File system error.
     Filename: /usr/share/grub/i386-redhat/e2fs_stage1_5
     No such file or directory
3.   File system error.
     Filename: /usr/share/grub/i386-redhat/fat_stage1_5
     No such file or directory
4.   File system error.
     Filename: /usr/share/grub/i386-redhat/ffs_stage1_5
     No such file or directory
5.   File system error.
     Filename: /usr/share/grub/i386-redhat/minix_stage1_5
     No such file or directory
6.   File system error.
     Filename: /usr/share/grub/i386-redhat/reiserfs_stage1_5
     No such file or directory
7.   File system error.
     Filename: /usr/share/grub/i386-redhat/stage1
     No such file or directory
8.   File system error.
     Filename: /usr/share/grub/i386-redhat/stage2
     No such file or directory
9.   File system error.
     Filename: /usr/share/grub/i386-redhat/vstafs_stage1_5
     No such file or directory
10.  File system error.
     Filename: /sbin/busybox
     No such file or directory
11.  File system error.
     Filename: /sbin/busybox.anaconda
     No such file or directory
12.  File system error.
     Filename: /sbin/debugreiserfs
     No such file or directory
13.  File system error.
     Filename: /sbin/dump
     No such file or directory
14.  File system error.
     Filename: /sbin/dump.static
     No such file or directory
15.  File system error.
     Filename: /sbin/ftl_check
     No such file or directory
16.  File system error.
     Filename: /sbin/ftl_format
     No such file or directory
17.  File system error.
     Filename: /sbin/hdparm
     No such file or directory
18.  File system error.
     Filename: /sbin/mkbootdisk
     No such file or directory
19.  File system error.
     Filename: /sbin/mkinitrd
     No such file or directory
20.  File system error.
     Filename: /sbin/mkraid
     No such file or directory
21.  File system error.
     Filename: /sbin/mkreiserfs
     No such file or directory
22.  File system error.
     Filename: /sbin/pcinitrd
     No such file or directory
23.  File system error.
     Filename: /sbin/raidstart
     No such file or directory
24.  File system error.
     Filename: /sbin/reiserfsck
     No such file or directory
25.  File system error.
     Filename: /sbin/resize_reiserfs
     No such file or directory
26.  File system error.
     Filename: /sbin/restore
     No such file or directory
27.  File system error.
     Filename: /sbin/restore.static
     No such file or directory
28.  File system error.
     Filename: /sbin/scsi_info
     No such file or directory
29.  File system error.
     Filename: /sbin/stinit
     No such file or directory
30.  File system error.
     Filename: /sbin/unpack
     No such file or directory
31.  File system error.
     Filename: /sbin/adjtimex
     No such file or directory
32.  File system error.
     Filename: /sbin/insmod.static
     No such file or directory
33.  File system error.
     Filename: /sbin/insmod_ksymoops_clean
     No such file or directory
34.  File system error.
     Filename: /sbin/klogd
     No such file or directory
35.  File system error.
     Filename: /sbin/minilogd
     No such file or directory
36.  File system error.
     Filename: /sbin/sndconfig
     No such file or directory
37.  File system error.
     Filename: /sbin/ifport
     No such file or directory
38.  File system error.
     Filename: /sbin/ifuser
     No such file or directory
39.  File system error.
     Filename: /sbin/ipx_configure
     No such file or directory
40.  File system error.
     Filename: /sbin/ipx_interface
     No such file or directory
41.  File system error.
     Filename: /sbin/ipx_internal_net
     No such file or directory
42.  File system error.
     Filename: /sbin/iwconfig
     No such file or directory
43.  File system error.
     Filename: /sbin/iwgetid
     No such file or directory
44.  File system error.
     Filename: /sbin/iwlist
     No such file or directory
45.  File system error.
     Filename: /sbin/iwpriv
     No such file or directory
46.  File system error.
     Filename: /sbin/iwspy
     No such file or directory
47.  File system error.
     Filename: /sbin/mgetty
     No such file or directory
48.  File system error.
     Filename: /sbin/mingetty
     No such file or directory
49.  File system error.
     Filename: /sbin/portmap
     No such file or directory
50.  File system error.
     Filename: /sbin/vgetty
     No such file or directory
51.  File system error.
     Filename: /sbin/ypbind
     No such file or directory
52.  File system error.
     Filename: /sbin/initlog
     No such file or directory
53.  File system error.
     Filename: /sbin/pam_tally
     No such file or directory
54.  File system error.
     Filename: /sbin/pwdb_chkpwd
     No such file or directory
55.  File system error.
     Filename: /sbin/rescuept
     No such file or directory
56.  File system error.
     Filename: /sbin/rmt
     No such file or directory
57.  File system error.
     Filename: /sbin/rpc.lockd
     No such file or directory
58.  File system error.
     Filename: /sbin/setsysfont
     No such file or directory
59.  File system error.
     Filename: /sbin/syslogd
     No such file or directory
60.  File system error.
     Filename: /sbin/cardctl
     No such file or directory
61.  File system error.
     Filename: /sbin/cardmgr
     No such file or directory
62.  File system error.
     Filename: /sbin/dump_cis
     No such file or directory
63.  File system error.
     Filename: /sbin/elvtune
     No such file or directory
64.  File system error.
     Filename: /sbin/hotplug
     No such file or directory
65.  File system error.
     Filename: /sbin/ide_info
     No such file or directory
66.  File system error.
     Filename: /sbin/lspnp
     No such file or directory
67.  File system error.
     Filename: /sbin/pack_cis
     No such file or directory
68.  File system error.
     Filename: /sbin/probe
     No such file or directory
69.  File system error.
     Filename: /sbin/shapecfg
     No such file or directory
70.  File system error.
     Filename: /sbin/kernelversion
     No such file or directory
71.  File system error.
     Filename: /sbin/genksyms
     No such file or directory
72.  File system error.
     Filename: /sbin/getkey
     No such file or directory
73.  File system error.
     Filename: /sbin/nash
     No such file or directory
74.  File system error.
     Filename: /sbin/sash
     No such file or directory
75.  File system error.
     Filename: /sbin/fsck.reiserfs
     No such file or directory
76.  File system error.
     Filename: /sbin/kallsyms
     No such file or directory
77.  File system error.
     Filename: /sbin/ksyms
     No such file or directory
78.  File system error.
     Filename: /sbin/mkfs.reiserfs
     No such file or directory
79.  File system error.
     Filename: /sbin/mount.ncp
     No such file or directory
80.  File system error.
     Filename: /sbin/mount.ncpfs
     No such file or directory
81.  File system error.
     Filename: /sbin/mount.smb
     No such file or directory
82.  File system error.
     Filename: /sbin/mount.smbfs
     No such file or directory
83.  File system error.
     Filename: /sbin/raid0run
     No such file or directory
84.  File system error.
     Filename: /sbin/raidhotadd
     No such file or directory
85.  File system error.
     Filename: /sbin/raidhotremove
     No such file or directory
86.  File system error.
     Filename: /sbin/raidstop
     No such file or directory
87.  File system error.
     Filename: /sbin/rdump
     No such file or directory
88.  File system error.
     Filename: /sbin/rdump.static
     No such file or directory
89.  File system error.
     Filename: /sbin/rrestore
     No such file or directory
90.  File system error.
     Filename: /sbin/rrestore.static
     No such file or directory
91.  File system error.
     Filename: /sbin/grub
     No such file or directory
92.  File system error.
     Filename: /sbin/grub-install
     No such file or directory
93.  File system error.
     Filename: /sbin/grub-md5-crypt
     No such file or directory
94.  File system error.
     Filename: /sbin/lilo
     No such file or directory
95.  File system error.
     Filename: /sbin/mkkerneldoth
     No such file or directory
96.  File system error.
     Filename: /var/lock/subsys/iptables
     No such file or directory
97.  File system error.
     Filename: /var/lock/subsys/portmap
     No such file or directory
98.  File system error.
     Filename: /var/lock/subsys/apmd
     No such file or directory
99.  File system error.
     Filename: /var/lock/subsys/atd
     No such file or directory
100. File system error.
     Filename: /var/lock/subsys/canna
     No such file or directory
101. File system error.
     Filename: /var/lock/subsys/crond
     No such file or directory
102. File system error.
     Filename: /var/lock/subsys/gpm
     No such file or directory
103. File system error.
     Filename: /var/lock/subsys/kudzu
     No such file or directory
104. File system error.
     Filename: /var/lock/subsys/netfs
     No such file or directory
105. File system error.
     Filename: /var/lock/subsys/nfslock
     No such file or directory
106. File system error.
     Filename: /var/lock/subsys/ntpd
     No such file or directory
107. File system error.
     Filename: /var/lock/subsys/random
     No such file or directory
108. File system error.
     Filename: /var/lock/subsys/sendmail
     No such file or directory
109. File system error.
     Filename: /var/lock/subsys/sshd
     No such file or directory
110. File system error.
     Filename: /var/lock/subsys/syslog
     No such file or directory
111. File system error.
     Filename: /var/lock/subsys/xfs
     No such file or directory
112. File system error.
     Filename: /var/lock/subsys/xinetd
     No such file or directory
113. File system error.
     Filename: /etc/sysconfig/network-scripts/ifdown-cipcb
     No such file or directory
114. File system error.
     Filename: /etc/sysconfig/network-scripts/ifdown-sl
     No such file or directory
115. File system error.
     Filename: /etc/sysconfig/network-scripts/ifup-cipcb
     No such file or directory
116. File system error.
     Filename: /etc/sysconfig/network-scripts/ifup-sl
     No such file or directory
117. File system error.
     Filename: /etc/modules.conf
     No such file or directory
118. File system error.
     Filename: /etc/named.conf
     No such file or directory
119. File system error.
     Filename: /etc/yp.conf
     No such file or directory
120. File system error.
     Filename: /etc/xinetd.conf
     No such file or directory
121. File system error.
     Filename: /etc/syslog.conf
     No such file or directory
122. File system error.
     Filename: /bin/sfxload
     No such file or directory
123. File system error.
     Filename: /bin/ash
     No such file or directory
124. File system error.
     Filename: /bin/ash.static
     No such file or directory
125. File system error.
     Filename: /bin/aumix-minimal
     No such file or directory
126. File system error.
     Filename: /bin/doexec
     No such file or directory
127. File system error.
     Filename: /bin/mt
     No such file or directory
128. File system error.
     Filename: /bin/zsh
     No such file or directory
129. File system error.
     Filename: /bin/bash2
     No such file or directory
130. File system error.
     Filename: /bin/bsh
     No such file or directory
131. File system error.
     Filename: /bin/ksh
     No such file or directory
132. File system error.
     Filename: /dev/cua0
     No such file or directory
133. File system error.
     Filename: /root/.Xresources
     No such file or directory
134. File system error.
     Filename: /root/.esd_auth
     No such file or directory
135. File system error.
     Filename: /root/.gnome
     No such file or directory
136. File system error.
     Filename: /root/.ICEauthority
     No such file or directory
137. File system error.
     Filename: /root/.Xauthority
     No such file or directory
138. File system error.
     Filename: /dev/kmem
     No such file or directory
139. File system error.
     Filename: /proc/ksyms
     No such file or directory
140. File system error.
     Filename: /proc/pci
     No such file or directory

-------------------------------------------------------------------------------
*** End of report ***

Open Source Tripwire 2.4 Portions copyright 2000-2017 Tripwire, Inc.  Tripwire is a registered
trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;
for details use --version. This is free software which may be redistributed
or modified only under certain conditions; see COPYING for details.
All rights reserved.
Integrity check complete.
[root@Gaspar ~]#

Leave a Reply

O seu endereço de e-mail não será publicado. Campos obrigatórios são marcados com *

Esse site utiliza o Akismet para reduzir spam. Aprenda como seus dados de comentários são processados.