Category Index:
/pub/COAST/Tripwire Category Index:
/pub/COAST/Tripwire
No Pointing!Gene H. Kim, Eugene
H. Spafford,
Experiences with Tripwire: Using Integrity Checkers for Intrusion
Detection
Abstract: This paper begins by motivating the need for an
integrity checker by presenting a hypothetical situation any
system administrator could face. An overview of Tripwire is then
described, emphasizing the salient aspects of Tripwire
configuration that supports its use at sites employing modern
variants of the UNIX operating system. Experiences with how
Tripwire has been used in "in the field" are then presented,
along with some conjectures on the prevalence and extent of
system breakin. Novel uses of Tripwire and no-table
configurations of Tripwire are also presented.
Gene H. Kim, Eugene
H. Spafford,
Writing, Supporting, and Evaluating Tripwire: A Publically
Available Security Tool
Abstract: This paper begins with brief overview of what
Tripwire does and how it works. It discuss how certain
implementation decisions affected the course of Tripwire
development, also presents other applications that have been
found for Tripwire.
Gene H. Kim, Eugene
H. Spafford,
The Design and Implementation of Tripwire: A File System
Integrity Checker
Abstract: This paper describes the design and
implementation of the Tripwire tool. It uses interchangeable
"signature" routines to identify changes in files, and is h
highly configurable.
Gene H. Kim, Eugene
H. Spafford,
Tripwire v1.2
Abstract: Tripwire is a highly portable, configurable tool
to monitor changes in a Unix filesystem. It keeps a database of
inode information and message digests of file and directory
contents based on a user-designed configuration file. When rerun,
Tripwire will compare the stored values against the configuration
flags and warn the operator of any deviations (changes,
additions, accesses, etc). Tripwire is extensively documented,
has been ported to over 30 varieties of Unix, and is highly
recommended by anyone who uses it.
Built by Mark Crosbie
and Ivan
Krsul.
Security Archive Homepage.
Purdue CS Dept page.
