Ubuntu Server25.10 : Tripwire , Logwatch,chkrootkit,disk usage check script,DNS Update

Tripwire

Implement a system to detect file tampering on Linux servers by crackers.
This time, Tripwire, a host-based IDS (IDS=Intrusion Detection System), will be installed as the file tampering detection system.
Tripwire detects file additions/changes/deletions by creating a database of file status at the time of installation and comparing the database with the current status of the file.。

1 Install

Tripwire requires a site passphrase to secure the "tw.cfg" Tripwire configuration file and the "tw.pol" Tripwire policy file.
Encrypt both files using the specified passphrase. A site passphrase is also required for a single instance of Tripwire.
During the installation process, you will be prompted to enter the "site key passphrase" and the "local key passphrase".

Creating a Site Key Passphrase

Creating a Local Key Passphrase
A local passphrase is required to protect the Tripwire database and report files. The local key used by Tripwire to prevent unauthorized changes to the Tripwire baseline database.

The installation is progressing and will complete.

2. Configuration File Settings

①twcfg.txt Edit

② Create a configuration file (encrypted signature version)

③ Optimize Policy
Use the following policy optimization scripts to optimize your policy

Policy Optimization Script Contents

Policy File Optimization

Create a policy file (encrypted and signed version) based on the optimized policy file.

Exclude the Tripwire database itself from being checked

④Database Creation

3. Functionality Verification

①Create test file

②Check Tripwire operation

If successful, the following display appears

Delete the test file.

4. Tripwire Autorun

①Create a script (tripwire.sh) for reporting results via email and set it to run automatically.

②Give execute permission and execute periodically by Cron.

Execute the following and verify that the results are delivered to the specified email address.

Logwatch

Logwatch aggregates various logs and sends them as a daily report via email. It's a useful tool for detecting unauthorized access and issues, as well as monitoring servers.

①Install

②Copy the default configuration file

➂Change email address, etc.

④Creating Directories

⑤operation check
When logwatch is installed, cron is registered by default, so you will receive daily report emails.
If you want to check it immediately, do the following

Chkrootkit

chkrootkit is a tool for detecting the presence of rootkits.
Note that chkrootkit is ineffective once the system has already been compromised, so this must be taken into consideration during installation.
Additionally, chkrootkit does not automatically address rootkits upon detection; manual intervention is required after detection.

①chkrootkit Install

➁Check for chkrootkit

④Creating a chkrootkit Scheduled Execution Script and Changing Permissions

Automatically, /etc/cron.daily/chkrootkit is created based on /usr/sbin/chkrootkit-daily and runs automatically every day, so no script creation is necessary.
This ensures that if a rootkit is installed, an email will be sent to root.

Disk Usage Check Script

1. Script creation

Contents of disk_capacity_check.sh

2. Execution Confirmation

①Check the current usage rate

It will be displayed as follows:

②Create dummy files to achieve a usage rate of 80% or higher (in this example, a file named dummyfile approximately 4GB in size).

③Reaffirm

Verify that it is running and has reached over 80%.

④Run the disk capacity check script

An email with the subject line "Disk usage alert: 91%" will be sent to the specified email address.

⑤Delete the created "dummyfile"

⑥Scheduled Execution Settings

DNS Update

Whenever the internet connection is lost or the router reboots, causing the global IP address to change, you must access the dynamic DNS service to notify it of the new IP address.

Create a dedicated Python file and schedule it for regular execution via Cron.
This time, it's about DNS settings in Valudomain.

Content of ddnsset.py

IP Address Log File Creation

Run periodically