Re: [gentoo-security] tripwire policy generator

[Michel Wilson]

On Thu, Mar 25, 2004 at 02:06:39AM +0000, Tom Hosiawa wrote:
> I've used tripwire a little bit, and I'm starting to like it.
>
> The biggest problem I see with it, is the default policy is setup for
> Red Hat, not for Gentoo. I know a Gentoo policy file exists in bugzilla,
> but I'm thinking of creating a script to generate the policy file based
> specifically on installed packages in portage.
>
> So before I go ahead with this plan, I thought I get some feedback on my
> ideas.
>
> >From playing around with the policy file, I see it groups and
> categorizes files into different security types and priorities such as
> critical, suid, config , log, etc.
>
> So for every installed package, I would put it into its own group. Than
> I would assign binary files (/bin, /usr/bin), superuser files (/sbin,
> /usr/sbin), suid (search for them), config (/etc), log (/var/log) files
> into their appropriate categories.
>
> Finally, providing options to generate it for only system packages with
> no user input, and individual package selection should be an option.
>
> Tom
>
Tripwire is nice, but I think a custom-developed solution would be much
better for Gentoo. Gentoo keeps md5-sums for each package in
/var/db/pkg/<category>/<package>/CONTENTS. What I would suggest is a
system whereby we sign these CONTENTS-files with a GPG key. A second
option would be to create a new file in this same location, specifically
designed for integrity checking.

Starting with the first option: this should be quite simple to implement.
Just build a script which signs all the CONTENTS-files with your GPG
key, and the database is build. Then, for each scan, the md5-sums of the
files are checked against the real file, and the md5-sum of the
CONTENTS-file is checked.
A disadvantage of this approach is that some of the flexibility of the
Tripwire system is lost. It is no longer possible to assign priorities
to the different files, or to completely ignore certain files. This is
where the second option comes in. Here, we are free to assign priorities
to the individual files. We can also specify which aspects of the file
should be checked: just the modification times, or the contents.

The major advantage of this integrated system would be that the integrity
information can be automatically updated if the user installs a new
package. Normally, with Tripwire, system maintenance is a nuisance. Every
time a new package is installed, Tripwire will generate false alarms.
Or, at least, when I used it it did, because I always forgot to update
the database...

Regards,

Michel Wilson.