How can I monitor a specific file on tripwire?

February 11, 2016 2.9k views
DigitalOcean Articles Linux Commands Linux Basics
redesbr
By:
redesbr

Let´s say that we have a file on “/etc/config.sh”. I would like to monitor this specific file with tripwire and make it generate form me a report if any changes are made on the file. Also, I would like tripwire to generate a report every 15 minutes. The report filename should have date and time on it.

Log In to Comment
1 Answer
AndrewTheTechie MOD February 18, 2016

Hey there redesbr,

We have a tutorial on setting up tripwire that will get you most of the way there: https://www.digitalocean.com/community/tutorials/how-to-use-tripwire-to-detect-server-intrusions-on-an-ubuntu-vps

After getting it up and running, it is just a matter of configuring it to match your specific needs.

Andrew
DigitalOcean TechOps

How To Use Tripwire to Detect Server Intrusions on an Ubuntu VPS
by Justin Ellingwood
Although it is possible to guard your server environment against attacks, it is important to be able to detect whether an intruder does manage to compromise your security. Tripwire is a tool that can be used to detect changes in the filesystem that may indicate that an unauthorized person has entered and modified files. In this guide, we will discuss how to install and configure tripwire on an Ubuntu 12.04 VPS.
Reply
Have another answer? Share your knowledge.

Related