Tripwire — Classic File Integrity Monitor
Why It Matters
Break-ins aren’t always obvious. No noisy alerts, no big red flags — just one binary swapped out, or a config file quietly edited. Tripwire was built for that job: checking if critical files change when they shouldn’t. It’s one of the oldest tools in the space, but admins still use it as a simple integrity watchdog.
How It Works
Tripwire builds a database of checksums and metadata for files you tell it to watch. Later scans compare the current state with that baseline. If something’s different — size, hash, permissions — it flags it. Reports are plain text or logs you can send to syslog. The open-source edition keeps it host-focused, while the commercial product adds dashboards, policies, and central management.
Technical Notes
| Area | Notes |
| Platforms | Linux, Unix; Windows in commercial edition |
| Main role | File integrity and change monitoring |
| Method | Cryptographic hashes + metadata comparison |
| Output | Text reports, syslog alerts |
| License | GPL (open-source), commercial enterprise edition |
Deployment Notes
– Install from distro repos or compile it.
– Run `tripwire –init` to set up a baseline.
– Add it to cron for regular scans.
– After legitimate updates, update the baseline — otherwise you’ll drown in alerts.
– Treat the baseline database itself like a sensitive file (keep it safe).
Where It Fits
– Compliance checklists where file monitoring is mandatory.
– Servers with critical configs or binaries.
– Forensics work: confirm if a system was tampered with.
– Both small shops and big orgs — open-source or commercial, depending on needs.
Caveats
– First run must be on a clean system — otherwise you “lock in” malware.
– Generates a lot of noise if you don’t maintain the baseline.
– Doesn’t block anything, just reports.
– Community edition is barebones; extra features live in the paid product.
