Experiences with Tripwire: Using Integrity Checkers for Intrusion Detection
Gene H. Kim, Eugene H. Spafford · Purdue e-Pubs (Purdue University System) · 1994
IntroductionTripwire is an integrity checking program written for the UNIX environment.It gives system administrators the ability to monitor file systems for added, deleted, and modified files.Imended to aid intrusion detection, Tripwire was officially released on November 2, 1992.It is being actively used at thousands of sites around the world.Published in volume 26 of camp.sources.Wlix on the USENET and archived at numerous FIP sites around the world, Tripwire is widely available and widely distributed.It is recommended by various computer security response teams, including the CERT and CIAC.This paper begins by motivating the need for an in• tegrity checker by presenting a hypothetical situation any system administrator could face.An overview of Tripwire is then described, emphasizing the salient aspects ofTripwire configuration that supports its use at sites employing modem variants of the UNIX operating system.Experiences with how Tripwire has been used in "in the field" are then presented, along with some conjectures on the prevalence and extent of system breakins.Novel uses of Tripwire and notable configurations of Tripwire are also presented."This paper appeared as [8]