Overview

Tripwire is the original file-integrity monitoring (FIM) tool: it takes a baseline snapshot of the files and directories you care about, then tells you whenever anything deviates from it. Open Source Tripwire (OST) is the GPL release of that codebase — the version upstream contributed to the community in October 2000 — and it is the tool that made “detect the change” a standard security control.

It was written in 1992 by Eugene Spafford and Gene Kim at Purdue University in direct response to a run of stealthy intrusions in 1991. Those attackers replaced shared libraries on compromised hosts while keeping their CRC checksums intact, so a checksum-only checker saw nothing. Tripwire’s answer, still in the code today, is to record several message digests from different hash families alongside the file’s metadata, so a weakness in one algorithm does not blind you. The name comes from the tripwire files used to catch snoopers. It was beta-released on 2 November 1992, formally released in December 1993, became a commercial product in 1997 and returned to the community as Open Source Tripwire 2.4 in 2000; the source moved from SourceForge to GitHub in May 2015, and the last tagged release is 2.4.3.7 (31 March 2018), which is the version still packaged by the distributions.

A Tripwire run is deliberately boring, which is the point. You compile a plain-text policy into a signed policy file, initialise a database of the files it covers, and then run a check on a schedule — from cron, from the packaged daily job, or by hand before and after a change window. The check prints a report (and writes it to disk, and can mail it) listing every added, removed and modified object, grouped by policy rule with a severity level, and you either fix the drift or accept it into the baseline with an update. There is no agent, no daemon and no network listener: the whole thing is four command-line programs, a policy file and a signed database.

Key Features

• The original baseline design — a database of metadata and signatures per object, compared on every check. New files appear as Added, deleted ones as Removed, and any changed property as Modified, so drift is reported as a diff rather than as an alert you have to tune.
• Multiple hashes from different families — the property mask selects CRC-32 (C), Haval (H), MD5 (M) and SHA (S) signatures per rule, so cheap digests can cover bulk data while strong ones guard the important paths, and a collision in one algorithm is not enough to hide a change.
• Metadata, not just contents — permissions (p), owner and group (u, g), size (s), modification, inode-change and access timestamps (m, c, a), inode number (i), link count (n), file type (t), device (r) and block count (b) can each be turned on or off per rule. A chmod, a new hard link or a touched timestamp is caught even though the bytes never changed.
• A real policy language — twpol.txt supports variables, reusable masks such as $(ReadOnly) and $(Growing), recursive and non-recursive trees, explicit “don’t scan this” entries, per-rule names and severity levels, and preprocessing for host-specific conditions — so one policy can serve a whole fleet and be compiled and signed once.
• Signed, optionally encrypted files — a site key signs the configuration and policy that many machines share, while a per-host local key signs the database and any signed reports. El Gamal keys are 1024-bit by default and 2048-bit with --key-size 2048, passphrases can be changed later with twadmin -m C, and unsigned mode is available where signing is impractical.
• Reports you can actually read — the check writes a report file (.twr) and prints it, with report levels 0–4 from a one-line summary to every recorded property on every changed object. twprint -m r -t 1 collapses a report to a bare list of changed paths, and twprint -m d prints the database itself, so the baseline can be audited like any other text file.
• Scheduled by design — the Debian package installs /etc/cron.daily/tripwire, and the report can be mailed (SMTP or a local MTA, with MAILFROMADDRESS and MAILNOVIOLATIONS to control noise) or sent to syslog, so drift reaches an administrator without anyone having to remember to run it.
• Small, portable, buildable anywhere — a C++ autotools project that builds on Linux, the BSDs, Solaris, AIX, HP-UX, macOS, Minix, Haiku and GNU/Hurd (plus Cygwin and DJGPP), with no runtime dependencies beyond libc and optional OpenSSL. --enable-static produces a stand-alone binary that does not trust the host’s shared libraries.

Why Use Tripwire?

Intrusion detection has two halves: catching an attack in progress, and noticing that one already succeeded. Tripwire covers the second half, and it does so without needing to know anything about the attacker. There is no signature database to update and no threat feed to trust — anything that differs from the trusted baseline is a finding, which means an attack nobody has seen before is reported just as plainly as a known one. Because the check is a comparison rather than a heuristic, false positives are almost always real changes to the files you chose to watch, which makes the reports worth reading.

It is also one of the few controls that stands up when the host is already compromised: the database and reports can be signed with a key the attacker does not have, the policy and configuration are readable but not quietly editable, and reading files with O_NOATIME means the check itself does not rewrite the timestamps it is watching. On top of that, file-integrity monitoring is a named requirement in most hardening baselines and audit frameworks, so Tripwire doubles as evidence. The trade-off is honest and worth stating: OST is a maintainer-thin, 2018-era codebase. It is stable, packaged by every major distribution and still perfectly usable, but if you want an actively developed alternative, AIDE, Wazuh or osquery are the modern choices.

Use Cases

• Baseline a server after a clean build — install and configure the host, run tripwire --init while you know the state is good, then let tripwire --check run daily from cron.
• Detect rootkits and backdoors — replaced binaries in /usr/bin, a modified /etc/passwd, a new setuid file or an added cron entry all show up as differences from the baseline.
• Watch a web root and its scripts — the recipe used for the screenshot below: a small policy covering site content, uploaded files and administrative scripts catches an injected script tag, a dropped PHP web shell and a loosened file mode in a single report.
• Protect the machine from itself — because the policy distinguishes read-only, configuration and growing files, package upgrades and log rotation are accepted into the baseline with tripwire --update while genuine surprises stay in the report.
• Compliance and audit evidence — signed daily reports over the paths an auditor asks about give a defensible, timestamped history of what changed and when.
• Catch snooping as well as tampering — access-time checking (a) on decoy files, the trick the tool is named after, reveals someone reading files they had no reason to open.
• Verify a fleet from one policy — the same signed policy can be distributed to many hosts while each keeps its own local key and database, so a shared standard walks in step with per-machine evidence.

Similar

Open Source Tripwire defined the category, so almost every file-integrity tool is measured against it. AIDE is the closest drop-in replacement, written specifically as its free successor and still actively maintained; Wazuh and its ancestor OSSEC fold file-integrity monitoring into a full host-based intrusion detection platform with real-time syscall watching; osquery exposes the same kind of host state as SQL so you can query for drift; auditd and Falco watch events and syscalls at runtime rather than comparing snapshots; chkrootkit, Rootkit Hunter and Lynis hunt known-bad traces and configuration weaknesses from the same host-centric vantage point.

Platform

Linux · FreeBSD, OpenBSD, NetBSD, DragonFly BSD and other BSDs · macOS · Solaris · AIX · HP-UX · Minix · Haiku · GNU/Hurd — plus Cygwin (and FreeDOS/DJGPP) builds which, as upstream notes, cannot monitor the Windows registry or Windows-specific attributes. There is no native Windows or container-first edition. Distributed as source (autotools: ./configure && make) and packaged by the distributions — Debian and Ubuntu ship the upstream 2.4.3.7 tree (Debian 13 “trixie” has 2.4.3.7-6), with RPM packages for the Red Hat family and a FreeBSD port.

Licence

GNU General Public License version 2 (GPL-2.0), or later at your option — free software, with the full licence text shipped in the repository as COPYING. The code was contributed by Tripwire, Inc. under the GPL in 2000; note that “Tripwire” itself remains a registered trademark of Tripwire, Inc., and the licence grants no trademark rights. Tripwire, Inc. still sells the commercial successors (Tripwire Enterprise, Configuration Compliance Manager) that the free release does not include.

Website

github.com/Tripwire/tripwire-open-source · releases · manual pages · README