Linux Security Cookbook

1.6. Remote Integrity Checking

Problem

You want to perform an integrity check, but to increase security, you store vital Tripwire files off-host.

Tip

In this recipe and others, we use two machines: your original machine to be checked, which we’ll call trippy, and a second, trusted machine we’ll call trusty. trippy is the untrusted machine whose integrity you want to check with Tripwire. trusty is a secure machine, typically with no incoming network access.

Solution

Store copies of the site key, local key, and tripwire binary on a trusted remote machine that has no incoming network access. Use rsync , securely tunneled through ssh, to verify that the originals and copies are identical, and to trigger an integrity check.

The initial setup on remote machine trusty is:

#!/bin/sh
REMOTE_MACHINE=trippy
RSYNC='/usr/bin/rsync -a --progress --rsh=/usr/bin/ssh'
SAFE_DIR=/usr/local/tripwire/${REMOTE_MACHINE}
VITAL_FILES="/usr/sbin/tripwire 
        /etc/tripwire/site.key 
        /etc/tripwire/${REMOTE_MACHINE}-local.key"

mkdir $SAFE_DIR
for file in $VITAL_FILES
do 
        $RSYNC ${REMOTE_MACHINE}:$file $SAFE_DIR/
done

Prior to running every integrity check on the local machine, verify these three files by comparing them to the remote copies. The following code should be run on trusty, assuming the same variables as in the preceding script (REMOTE_MACHINE, etc.):

#!/bin/sh cd $SAFE_DIR rm -f log for file in $VITAL_FILES do base=`basename $file` $RSYNC -n ${REMOTE_MACHINE}:$file . | fgrep -x "$base" >> log done if [ -s log ...