Trip Wire#

Simple Tripwire POSIX shell script

#!/bin/sh

rootdir='/'

exclude=\
'container|cache|'\
'\/[a-f0-9]{3,}_0|'\
"^$HOME"\
'/.(bash_history|viminfo|.cache/google)'

include='^/(etc|dev)'

# Use find to get all files that have changed since a specific time.
#   0 mean last 24 hours
#   1 means 24-48 hours

find "$rootdir" -type f -mtime 0 2>/dev/null | \
grep -E "$include" | \
grep -E -v "$exclude"


# Coded by: Raymond C. TURNER

Detailed Explanation of the shell Code

The provided shell script appears to be a script written in the Bourne shell (/bin/sh) that is used to search for and list files in a specific directory (rootdir) that have been modified within the last 24 hours (mtime 0). The script also includes patterns for exclusion (exclude) and inclusion (include) of certain files and directories. Let's break down the script step by step:

Setting Variables:

rootdir='/'
exclude=\
'container|cache|'\
'\/[a-f0-9]{3,}_0|'\
"^$HOME"\
'/.(bash_history|viminfo|.cache/google)'
include='^/(etc|dev)'

Here, the script sets up several variables:

rootdir: This is set to '/', which indicates the root directory. The script will search for files within this directory.
exclude: This variable contains multiple regular expressions separated by backslashes (\). It's used to define patterns for excluding specific files and directories from the search.
- 'container|cache|': Matches any file or directory name containing the words "container" or "cache".
- '\/[a-f0-9]{3,}_0|': Matches files or directories with names consisting of hexadecimal characters of at least 3 characters followed by _0 (e.g., abc_0).
- "^$HOME": Excludes files in the user's home directory ($HOME). The ^ symbol denotes the start of the line, and $HOME is replaced with the user's home directory path.
- '/.(bash_history|viminfo|.cache/google)': Excludes certain hidden files or directories like .bash_history, .viminfo, and .cache/google.
include: This variable defines a regular expression pattern to include specific directories in the search.
- ^/(etc|dev): Includes files and directories under /etc and /dev.
- File Search and Filtering:

find "$rootdir" -type f -mtime 0 2>/dev/null | \
    grep -E "$include" | \
    grep -E -v "$exclude"

find "$rootdir" -type f -mtime 0 2>/dev/null: Uses the find command to search for regular files (-type f) in the specified rootdir that have been modified within the last 24 hours (-mtime 0). The 2>/dev/null part redirects error messages to /dev/null, effectively suppressing them.
grep -E "$include": Pipes the output of the find command to grep with the -E flag (extended regular expression mode) and matches the files and directories that match the inclusion pattern specified by include.
grep -E -v "$exclude": Further pipes the output to another grep command with the -v flag to exclude files and directories that match the exclusion pattern specified by exclude.

In summary, this script is designed to search for regular files within the specified rootdir that have been modified within the last 24 hours. It filters the results using regular expressions defined in the include and exclude variables to include specific directories and exclude certain patterns. The final list of files meeting the inclusion and exclusion criteria is displayed as the output.

Benefits of a Tripwire

A "tripwire" in the context of computer security and cybersecurity is a security mechanism that monitors and detects unauthorized changes in a system or network. It derives its name from the real-world analogy of a physical tripwire that, when triggered, sets off an alarm. In the digital realm, a tripwire serves as a safeguard against unauthorized access, tampering, or modifications to critical files, configurations, or settings.

A tripwire system typically consists of the following components:

Baseline Configuration: Initially, the system's desired state is defined and documented. This includes information about files, directories, permissions, and other configurations that should not change unless authorized.
Monitoring Mechanism: The tripwire system continuously monitors the specified files, directories, and settings for any alterations. This is often done through the use of cryptographic hash functions, which generate unique checksums (hashes) for the files and configurations.
Database of Hashes: The calculated hashes of the baseline configuration are stored in a secure database. These hashes serve as reference points to compare against the current state of the system.
Change Detection: As the system operates, the tripwire system regularly recalculates the hashes of the monitored files and configurations. If any changes occur, such as files being added, deleted, or modified, the system will detect the discrepancies.
Alerting and Response: When unauthorized changes are detected, the tripwire system generates alerts, notifications, or logs to inform system administrators or security personnel about the potential security breach. This allows them to investigate the incident and take appropriate actions to mitigate the risk.

Tripwire systems can serve various purposes, including:

Intrusion Detection: Identifying unauthorized access or tampering attempts by external attackers or malicious insiders.
Change Control: Monitoring changes in critical system files and configurations to ensure compliance with security policies and prevent unauthorized modifications.
Forensic Analysis: Providing a trail of evidence that can be used in post-incident investigations to understand the scope and impact of a security breach.
Configuration Management: Ensuring the integrity of software installations, updates, and patches to prevent unauthorized modifications that could lead to vulnerabilities.
Learning Benefits: Coding a basic tripwire offers numerous learning benefits, including cybersecurity, software development, DevOps, SysAdmin tasks, and various Linux/Unix tasks.
What is the difference between an interactive shell and shell scripting?
What is the difference between GPLv2 and GPLv3 licenses?
Everyone should use shellcheck.
Dynamic shellcheck with Vim Ale.
Learning POSIX shell and bash.
Coding your own tripwire program to catch hackers (in 20 lines of shell code).
The find command, perhaps the least appreciated in all of UNIX.
It's Good practice to Play around with it to get good with find and regular expressions (regex).

It's important to note that while tripwire systems can be effective in detecting unauthorized changes, they should be carefully configured and maintained to avoid false positives (detecting harmless changes as security incidents) and false negatives (failing to detect actual security breaches). Additionally, the security of the tripwire system itself is crucial, as an attacker who gains control of the tripwire system could manipulate its results to avoid detection.

Developed and Documentation By: Raymond C. TURNER

Last Updated: Monday 28^th August 2023 @ 01:24 BST