Thread View: comp.security.misc
2 messages
2 total messages
Started by Gene Spafford
Tue, 03 Nov 1992 21:53
Tripwire release
Author: Gene Spafford
Date: Tue, 03 Nov 1992 21:53
Date: Tue, 03 Nov 1992 21:53
52 lines
3022 bytes
3022 bytes
This is to announce the first public release of "Tripwire." Tripwire is an integrity-monitor for Unix systems. It uses several checksum/signature routines to detect changes to files, as well as monitoring selected items of system-maintained information. The system also monitors for changes in permissions, links, and sizes of files and directories. It can be made to detect additions or deletions of files from watched directories. The configuration of Tripwire is such that the system/security administrator can easily specify files and directories to be monitored or to be excluded from monitoring, and to specify files which are allowed limited changes without generating a warning. Tripwire can also be configured with customized signature routines for site-specific checks. Tripwire, once installed on a clean system, can detect changes from intruder activity, unauthorized modification of files to introduce backdoor or logic-bomb code, (if any were to exist) virus activity in the Unix environment. Tripwire is provided as source code with documentation. The system, as delivered, performs no changes to system files and does not require root privilege to run (in the general case). The code has been beta-tested in a form close to that of this release at over 100 sites world-wide. Tripwire should work on almost any version of Unix, from Xenix on 80386-based machines to Cray and ETA-10 supercomputers. Tripwire may be used without charge, but it may not be sold or modified for sale. Tripwire was written as a project under the auspices of the COAST Project at Purdue University. The primary author was Gene Kim, with the aid and under the direction of Gene Spafford (COAST director). Copies of the Tripwire distribution may be ftp'd from ftp.cs.purdue.edu from the directory pub/spaf/COAST/Tripwire. The distribution is available as a compressed tar file, and as uncompressed shar kits. The shar kit form of Tripwire version 1.0 will also be posted to comp.sources.unix on the Usenet. No mailserver access currently exists for distribution, although we expect some archive sites with such mechanisms will eventually provide access. Questions, comments, complaints, bugfixes, etc may be directed to: genek@mentor.cc.purdue.edu (Gene Kim) spaf@cs.purdue.edu (Gene Spafford) 3 November 1992 -- Gene Spafford Software Engineering Research Center & Dept. of Computer Sciences Purdue University, W. Lafayette IN 47907-1398 Internet: spaf@cs.purdue.edu phone: (317) 494-7825
Re: Tripwire release
Author: Kevin McCurley
Date: Wed, 04 Nov 1992 20:38
Date: Wed, 04 Nov 1992 20:38
29 lines
2180 bytes
2180 bytes
In article <Bx5uwo.30F@mentor.cc.purdue.edu> spaf@cs.purdue.EDU (Gene Spafford) writes: >This is to announce the first public release of "Tripwire." > >Tripwire is an integrity-monitor for Unix systems. It uses several >checksum/signature routines to detect changes to files, as well as I would like to comment that this use of the term "signature" should not be confused with the much stronger term of signature that is common in cryptology literature. The "signatures" provided in Tripwire appear to be nothing more than checksums (also known as cryptographically secure hash functions). The difference is that a checksum for a given file can be produced easily by anyone, and therefore verified easily by anyone. In cryptology literature, the term signature is used to denote something that is hard to create without secret information, but is easily verifiable by anyone. MD5 is a checksum, whereas the proposed DSS provides a digital signature. The major difference in practice is that if a system critical file like /etc/passwd can be changed, then presumably a checksum of that file can also be changed. On the other hand, a legitimate digital signature like DSS or RSA cannot be produced when the file is changed without access to some secret information that is presumably not even stored on the machine (or any machine). You will notice that the Tripwire database needs to be placed in a secure location like on another machine with a read-only disk. If a true digital signature algorithm was used (like DSS or RSA), then this would not be necessary. Kevin McCurley
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads