tripwire_agent

Cookbook installs Tripwire Enterprise Agents, either Axon or Java. This cookbook also provides a resource to upgrade a Java agent

Features

This cookbook provides resources for the installation of Tripwire Enterprise Axon and Java agents. Users are able to include this cookbook in their own cookbooks or use the cookbook on its own to install their agents within their infrastructure. A recipe is also included to migrate a system from a Java agent to an Axon agent.

Requirements

• Chef 13 or higher
• Tripwire Enterprise installers available through a share or web service

Provider Documentation

Axon Parameters

Axon Actions

• :install - Default action, Installs the Axon agent
• :remove - Removes an existing Axon agent

Java Parameters

Java Actions

• :install - Default action, Installs the Java agent
• :remove - Removes the java agent

Required properties

Java
* installer
* console
* services_password

Axon
* installer
* eg_driver_installer (if installing EG/RTM, linux/debian only)
* eg_service_installer (if installing EG/RTM, linux/debain only)
* dns_srvc_name (if using DNS to direct agent to the bridge)
* dns_srvc_domain (if using DNS)
* bridge_server (if providing the IP/Hostname of the bridge)
* keystore_password (if using PKI)
* registration_key (if using a registration key to authenticate to the bridge)

Attributes

Provider Usage

Axon

Place this dependency inside your cookbooks metadata.rb.

depends 'tripwire_agent'

Within your recipe specifying all of the installer binaries:

tripwire_agent_axon 'Installing the Tripwire Axon Agent' do
  installer '/mnt/share/tripwire/axon-agent-installer-linux-x64.rpm'
  eg_driver_installer '/mnt/share/tripwire/tw-eg-driver.x86_64.rpm'
  eg_service_installer '/mnt/share/tripwire/tw-eg-service.x86_64.rpm'
  bridge 'tw-console.example.com'
  registration_key 'PaS5w0rd!_K3y'
  tags "Platform" => "Red Hat", "Policy" => ["PCI", "SOX"], "Importance" => "High", "Org" => ["Payment", "Sales", "Production"]
end

Within your recipe specifying the packaged tar file from Tripwire Customer Center:
ruby
tripwire_agent_axon 'Installing the Tripwire Axon Agent' do
installer '/mnt/share/tripwire/axon-agent-installer-linux-x64.tgz'
bridge 'tw-console.example.com'
registration_key 'PaS5w0rd!_K3y'
tags "Platform" => "Red Hat", "Policy" => ["PCI", "SOX"], "Importance" => "High", "Org" => ["Payment", "Sales", "Production"]
end


The configurations above will install the Axon agent, EG Driver, EG Service onto the platform. The twagent.conf file will be set to point to the bridge server and sets a registration password file (This file will be removed once the agent successfully registers with the bridge). Tagging file will also be created and will be used only once during the first time the agent connects to the bridge for Tripwire Enterprise.

Java

Place this dependency inside your cookbooks metadata.rb.

depends 'tripwire_agent'

Within your recipe:

tripwire_agent_java 'Install Tripwire Java Agent' do
  installer '/mnt/share/tripwire/te_agent.bin'
  console 'tw-console.example.com'
  services_password 'Pas5W0rd!_C0mp13x!Ty^'
  tags "Platform" => "Red Hat", "Policy" => ["PCI", "SOX"], "Importance" => "High", "Org" => ["Payment", "Sales", "Production"]
end

The configuration above will install the Tripwire Java agent and point it at the Tripwire Enterprise console. It will register with a hash of tags when the agent first registers to the console server.

Recipe Usage

Axon

Sample Installation Role:

chef_type:                  role
default_attributes:
description:                Axon agent install for Linux, no DNS record
env_run_lists:
json_class:                 Chef::Role
name:                       axon_install_linux_x64
override_attributes:
  tripwire_agent:
    installer:              '/mnt/share/tripwire/axon-agent-installer-linux-x64.tgz'
    tags:                   {"Platform": "Red Hat", "Policy": ["PCI", "SOX"], "Importance": "High", "Org": ["Payment", "Sales", "Production"]}
    axon:
      bridge:               'tw-console.example.com'
      registration_key:     'PaS5w0rd!_K3y'
run_list:
  recipe[tripwire_agent::axon_agent]

Sample Migration Role:

chef_type:                  role
default_attributes:
description:                Axon agent install for Linux, no DNS record
env_run_lists:
json_class:                 Chef::Role
name:                       axon_install_linux_x64
override_attributes:
  tripwire_agent:
    installer:              '/mnt/share/tripwire/axon-agent-installer-linux-x64.tgz'
    tags:                   {"Platform": "Red Hat", "Policy": ["PCI", "SOX"], "Importance": "High", "Org": ["Payment", "Sales", "Production"]}
    axon:
      bridge:               'tw-console.example.com'
      registration_key:     'PaS5w0rd!_K3y'
run_list:
  recipe[tripwire_agent::migrate]

Java

Java recipes include a removal recipe and an installation recipe.

Sample Role:

chef_type:                  role
default_attributes:
description:                Java agent install for Linux
env_run_lists:
json_class:                 Chef::Role
name:                       java_install_linux_x64
override_attributes:
  tripwire_agent:
    installer:              '/mnt/share/tripwire/te_agent.bin'
    tags:                   {"Platform": "Red Hat", "Policy": ["PCI", "SOX"], "Importance": "High", "Org": ["Payment", "Sales", "Production"]}
    java:
      console:              'tw-console.example.com'
      services_password:    'Pas5W0rd!_C0mp13x!Ty^'
run_list:
  recipe[tripwire_agent::java_agent]

To-Do

• Support custom pki registration

Gotchas

• Axon agents requires some method of knowing about the bridge, either through DNS pointer record or manually configuring the bridge through the attribute or when using the resource in your cookbook.
  • Please see the Installation and Maintenance guide for any additional information
• Installation of the DKMS driver for the event generator service requires that the DKMS package is already installed on the system.
• Axon Windows agents will automatically start post installation
  • Linux Axon agents can be prevented from starting post installation
  • Java agents for Windows and Linux can be prevented from starting post installation
• Alternative installation paths for Java agents are not supported on Debian platforms
• Alternative installation paths on Axon are currently not supported
• Integration Port for Java agents will only be set if FIPS is enabled

Contributing

See the contribution guidelines for more information.