# I need a Tripwire Guide

## drspewfy

hello Gentoo userss!

i need a tripwire guide, manual or tutorial to learn how to use tripwire and if is based in gentoo better!..

.thanks alot!

seeeya

----------

## BackSeat

There's this really great site, http://www.google.com, where you can actually search the Internet for things. Imagine that! You can search the Internet! Or would you like me to do that for you, and tell you exactly what I have managed to find?

BS

----------

## Derringer

I'm assuming hes asking for recommended guides on the subject, not thinly veiled 'RTFM's.

Does anyone believe, honestly, that people who use Internet messageboards do not know how to use Google?  I'm sure the guy has looked there.. cut people some slack and give them input if you can, but otherwise, a reply post like that isn't helpful or funny.

----------

## BackSeat

Fair enough, I'll do it for him. This is a good, albeit brief, guide, and the Red Hat manual is quite helpful too.

If they don't answer your questions then ask away here.

BS

----------

## slartibartfasz

the guys from the gentoo hardened project seem to like AIDE and Prelude as free tripwire replacements. some basics can be found  here and here.

Prelude: http://www.prelude-ids.org/

AIDE: http://sourceforge.net/projects/aide/

maybe you also want to take a look at the homepage of the hardened projet

----------

## fcgreg

 *slartibartfasz wrote:*   

> the guys from the gentoo hardened project seem to like AIDE and Prelude as free tripwire replacements. some basics can be found  here and here.
> 
> Prelude: http://www.prelude-ids.org/
> 
> AIDE: http://sourceforge.net/projects/aide/

 

Thanks for that great info.  I've been searching around for a free replacement for Tripwire, and this should fill the bill nicely.

I knew we Gentoo'ers would have some good options for such things.  I love this place!

----------

## slartibartfasz

 *fcgreg wrote:*   

>  *slartibartfasz wrote:*   the guys from the gentoo hardened project seem to like AIDE and Prelude as free tripwire replacements. some basics can be found  here and here.
> 
> Prelude: http://www.prelude-ids.org/
> 
> AIDE: http://sourceforge.net/projects/aide/ 
> ...

 

another pleased customer  :Wink: 

i have to admit that i usually look here first when im searching for something - more often than not i find what i was looking for and in a faster and nicer way than anywhere else  :Smile: 

----------

## mazirian

I had some difficulty finding straightfoward instructions myself, so I know how you feel.  There are old docs here:

[url]

http://sourceforge.net/project/showfiles.php?group_id=3130

[/url] 

That manual has sufficed perfectly well for me.  It's a rather large .pdf, and it's actually worth the time to scan through the at least the first half of it.

I found tripwire easier to maintain than AIDE, and also it has the added security of encrypting its config files (does AIDE do that now?).  It all depends on how adamant you are about maintaining a purely open source system, I suppose.

----------

## drspewfy

not AIDE doesnt encrypt the files, yet

i recomend you to use tripwire, is really good,

but is you want a real HOst IDS.. but is really hard to install it is

SE linux... http://www.nsa.gov/selinux/

the manuals of tripwire are everywhere, just make a google like i did, and any one is good.

=)

bye

----------

## casper

for tripwire i looked for the red hat manual. For install it's really good. For more advanced things I just google searched for tripwire + whataver my problem was and I found what i needed.

about SELinux...when 2.6 came with it, I though of giving it a try. In between 2.6.1-rc1 and 2.6.1-rc3 i took it out of my kernel build  :Smile:  it was REALLY hard to get anything with it, and although I might make this effort for a huge company server or something like that, I decided it's really not worth it for the server in my room.   :Rolling Eyes:  [/quote]

----------

## MrCoffee

 *slartibartfasz wrote:*   

> the guys from the gentoo hardened project seem to like AIDE and Prelude as free tripwire replacements. some basics can be found  here and here.
> 
> 

 

That helped me too.  I keep forgetting to look here first!

----------

