This recipe shows you how to set up Tripwire, an auditing tool for detecting changes made to files on your system. Most often, Tripwire is positioned as an intrusion detection system because the unexpected modification of important configuration files is usually a sign of intrusion or malicious activity. Being able to monitor for such changes gives you the ability to detect and put a stop to malicious activity in a timely manner should it occur.
This recipe requires a CentOS system with a working network connection. The tripwire package is found in the EPEL repository, so the repository must be registered as discussed in Chapter 4, Software Installation Management. Administrative privileges are also required, either by logging in with the root account or through the use of sudo.