RE: [Tripwire-dev] Newbie question -- Securing Tripwire

[Eric L. <tri...@er...>]

That's a really slick way of doing things, but I'm just not sure I'm ready
to jump off that bridge yet. Maybe down the road I'll get some time to play
with Xen.

What I am thinking about doing at this point is moving the binaries and
key-files to a locked usb jump drive, and leaving the db on the hd. This
gives me secured binaries and key files, while still allowing me to update
the database remotely when known changes occur. 

I suppose I could put a copy of the database on the jump drive, but updating
the database on the jump drive is kind of a pain since the datacenter is a
~50 drive each way and when we bring up our redundant datacenter it's even
worse. I really don't want to have to go into the datacenter each time I
have a code release.

Am I way off base for doing things this way?

  

> -----Original Message-----
> From: tri...@li... 
> [mailto:tri...@li...] On Behalf 
> Of Steve Wray
> Sent: Saturday, February 18, 2006 12:51 PM
> To: Eric Langheinrich
> Cc: tri...@li...
> Subject: Re: [Tripwire-dev] Newbie question -- Securing Tripwire
> 
> Eric Langheinrich wrote:
> > I am just starting to work with tripwire and have a question about 
> > securing the check process.
> > 
> > Most of what I have read tells me that I need to store the 
> database on 
> > read-only media, but I seem to recall reading somewhere 
> that I really 
> > only need to store the binary, key files, and maybe the 
> > configuration/policy file on read only media. Obviously, 
> not having to 
> > store the database on read-only media is advantageous since 
> I can then 
> > update the database remotely when system changes are performed.
> > 
> > What is the right way to secure tripwire? Does the binary 
> check that 
> > the database is signed with the proper key when a 'tripwire 
> --check' 
> > is performed? Do I need to store that database on read-only media?
> 
> 
> Ok, so this may not work for everyone, but I may have found 
> the ultimate way to secure tripwire.
> 
> We use xen virtualisation.
> 
> The xen host mounts the virtual machines filesystem read-only 
> and tripwire running on the host checks the mounted filesystem.
> 
> The virtual machine has no tripwire installation at all, 
> nothing to be compromised.
> 
> The host doesn't even need to have an internet-facing network 
> connection (it needs a physical interface, but it doesn't 
> need to listen on it).
> 
> 
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep 
> through log files for problems?  Stop!  Download the new AJAX 
> search engine that makes searching your log files as easy as 
> surfing the  web.  DOWNLOAD SPLUNK!
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&
dat=121642
> _______________________________________________
> Tripwire-dev mailing list
> Tri...@li...
> https://lists.sourceforge.net/lists/listinfo/tripwire-dev
>