Add Tripwire integrity rules

components/tripwire.yml

@@ -0,0 +1,9 @@
+name: tripwire
+groups:
+  - tripwire
+packages:
+  - tripwire
+rules:
+  - package_tripwire_installed
+  - tripwire_build_database
+  - tripwire_periodic_cron_checking

linux_os/guide/system/software/integrity/software-integrity/tripwire/group.yml

@@ -0,0 +1,12 @@
+documentation_complete: true
+
+title: 'Verify Integrity with Tripwire'
+
+description: |-
+    Tripwire conducts integrity checks by comparing hashes and metadata of
+    files against a previously-generated, known-good database. It is a
+    common alternative to AIDE for this purpose. The database should be
+    created immediately after initial system configuration and regenerated
+    after any software update.
+
+platform: system_with_kernel

linux_os/guide/system/software/integrity/software-integrity/tripwire/package_tripwire_installed/rule.yml

@@ -0,0 +1,23 @@
+documentation_complete: true
+
+title: 'Install Tripwire'
+
+description: |-
+    {{{ describe_package_install(package="tripwire") }}}
+
+rationale: |-
+    The tripwire package provides the Tripwire file and directory integrity
+    checker, a common alternative to AIDE. It must be installed for any
+    integrity checking to be possible.
+
+severity: medium
+
+references:
+    nist: CM-6(a)
+
+{{{ complete_ocil_entry_package_installed("tripwire") }}}
+
+template:
+    name: package_installed
+    vars:
+        pkgname: tripwire

linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/oval/shared.xml

@@ -0,0 +1,20 @@
+<def-group>
+  <definition class="compliance" id="{{{ rule_id }}}" version="1">
+    {{{ oval_metadata("The Tripwire database must be initialized to provide a known-good baseline for integrity checks.", rule_title=rule_title) }}}
+    <criteria operator="AND">
+      <extend_definition comment="tripwire is installed" definition_ref="package_tripwire_installed" />
+      <criterion test_ref="test_tripwire_database_initialized" comment="Tripwire operational database file exists" />
+    </criteria>
+  </definition>
+
+  <unix:file_test id="test_tripwire_database_initialized" check="all"
+  check_existence="at_least_one_exists" version="1"
+  comment="Testing existence of the Tripwire operational database file">
+    <unix:object object_ref="object_tripwire_database_file" />
+  </unix:file_test>
+
+  <unix:file_object id="object_tripwire_database_file" version="1">
+    <unix:path>/var/lib/tripwire</unix:path>
+    <unix:filename operation="pattern match">^.*\.twd$</unix:filename>
+  </unix:file_object>
+</def-group>

linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/rule.yml

@@ -0,0 +1,37 @@
+documentation_complete: true
+
+title: 'Build and Initialize Tripwire Database'
+
+description: |-
+    Run the following command to generate the initial known-good database,
+    supplying the local passphrase when prompted:
+    <pre>$ sudo tripwire --init</pre>
+    By default the database is written to
+    <tt>/var/lib/tripwire/$(HOSTNAME).twd</tt>, as configured by the
+    <tt>DBFILE</tt> directive in <tt>/etc/tripwire/twcfg.txt</tt>.
+    To run a manual integrity check afterwards:
+    <pre>$ sudo tripwire --check</pre>
+    If the check produces unexpected output, investigate.
+
+rationale: |-
+    For Tripwire to be effective, an initial database of "known-good"
+    information about files must be captured so that installed files can be
+    verified against it.
+
+severity: medium
+
+references:
+    nist: CM-6(a)
+
+warnings:
+    - general: |-
+        This rule doesn't come with a remediation; <tt>tripwire --init</tt>
+        requires the site and local passphrases to be entered interactively
+        and must be run by the administrator.
+
+ocil_clause: 'the Tripwire database file has not been created'
+
+ocil: |-
+    To verify the Tripwire database has been initialized, run:
+    <pre>$ sudo ls -l /var/lib/tripwire/*.twd</pre>
+    A <tt>.twd</tt> database file should be present.

linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/tests/database_missing.fail.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# packages = tripwire,linux-base
+# platform = multi_platform_debian
+# remediation = none
+
+# No .twd database file exists yet, so the Tripwire database hasn't been
+# initialized. Expected result: FAIL.
+mkdir -p /var/lib/tripwire
+rm -f /var/lib/tripwire/*.twd

linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/tests/database_present.pass.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# packages = tripwire,linux-base
+# platform = multi_platform_debian
+
+# A .twd database file is present, matching the DBFILE default documented
+# in twconfig(4) (/var/lib/tripwire/$(HOSTNAME).twd). Expected result: PASS.
+mkdir -p /var/lib/tripwire
+touch "/var/lib/tripwire/$(hostname).twd"

linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/oval/shared.xml

@@ -0,0 +1,21 @@
+<def-group>
+  <definition class="compliance" id="{{{ rule_id }}}" version="1">
+    {{{ oval_metadata("Tripwire must run on a schedule so unexpected file changes are revealed promptly.", rule_title=rule_title) }}}
+    <criteria operator="AND">
+      <extend_definition comment="tripwire is installed" definition_ref="package_tripwire_installed" />
+      <criterion test_ref="test_tripwire_cron_periodic" comment="tripwire check scheduled in /etc/cron.{daily,weekly}" />
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists"
+  id="test_tripwire_cron_periodic" version="1"
+  comment="tripwire check scheduled via /etc/cron.{daily,weekly}">
+    <ind:object object_ref="object_tripwire_cron_periodic" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_tripwire_cron_periodic" version="1">
+    <ind:path operation="pattern match">^/etc/cron\.(daily|weekly)$</ind:path>
+    <ind:filename operation="pattern match">^.*$</ind:filename>
+    <ind:pattern operation="pattern match">tripwire[^\n]*(?:--check|-m\s+c)</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>

linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/rule.yml

@@ -0,0 +1,27 @@
+documentation_complete: true
+
+title: 'Configure Periodic Execution of Tripwire'
+
+description: |-
+    Tripwire should run at least weekly. The Debian <tt>tripwire</tt> package
+    installs <tt>/etc/cron.daily/tripwire</tt> by default, which runs
+    <tt>tripwire --check</tt> once a day and mails the report to root. The
+    script can instead be moved to <tt>/etc/cron.weekly</tt> if weekly checks
+    are preferred.
+
+rationale: |-
+    By default, integrity checking tools do not run themselves periodically.
+    Running Tripwire on a schedule is necessary to reveal unexpected changes
+    to installed files in a timely manner.
+
+severity: medium
+
+references:
+    nist: SI-7,SI-7(1),CM-6(a)
+
+ocil_clause: 'Tripwire is not configured to run periodically'
+
+ocil: |-
+    Run the following command to check for a scheduled Tripwire run:
+    <pre>$ ls -l /etc/cron.daily/tripwire /etc/cron.weekly/tripwire 2>/dev/null</pre>
+    A script invoking <tt>tripwire --check</tt> should be present.

linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/cron_weekly.pass.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+# packages = tripwire,linux-base
+# platform = multi_platform_debian
+
+# The Debian package's default script may be relocated to a less
+# frequent cron directory if daily checks are too frequent.
+# Expected result: PASS.
+rm -f /etc/cron.daily/tripwire
+mkdir -p /etc/cron.weekly
+cat > /etc/cron.weekly/tripwire <<EOF
+#!/bin/sh -e
+tripwire=/usr/sbin/tripwire
+[ -x \$tripwire ] || exit 0
+umask 027
+\$tripwire --check --quiet --email-report
+EOF
+chmod +x /etc/cron.weekly/tripwire

linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/no_schedule.fail.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# packages = tripwire,linux-base
+# platform = multi_platform_debian
+# remediation = none
+
+# Neither /etc/cron.daily/tripwire nor /etc/cron.weekly/tripwire exists,
+# so no periodic check is scheduled. Expected result: FAIL.
+rm -f /etc/cron.daily/tripwire /etc/cron.weekly/tripwire

linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/packaged_default.pass.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+# packages = tripwire,linux-base
+# platform = multi_platform_debian
+
+# Matches the /etc/cron.daily/tripwire script shipped by the Debian
+# tripwire package, written explicitly instead of relying on the
+# package's post-install state so this scenario stays deterministic
+# across package versions. Expected result: PASS.
+mkdir -p /etc/cron.daily
+cat > /etc/cron.daily/tripwire <<EOF
+#!/bin/sh -e
+tripwire=/usr/sbin/tripwire
+[ -x \$tripwire ] || exit 0
+umask 027
+\$tripwire --check --quiet --email-report
+EOF
+chmod +x /etc/cron.daily/tripwire