[NCLUG] tripwire

[Mike Loseke]

Thus spake Daniel Herrington:
> I get errors emailed to root that say something about a cron job for
> tripwire failing because I haven't initialized tripwire.  Why would I
> want to initialize it? (besides getting rid of that email. ;-)  Is it
> really that beneficial?

 Last time I looked at it I understood it to be a mechanism for informing
you when certain system files change (like /etc/passwd or /etc/hosts type
of files). So if a cracker got in and changed something, tripwire would
find out and notify you - after the fact. I didn't find it all that
beneficial myself, but others might.

-- 
   Mike Loseke    |
 mike at verinet.com | Programmer, hack thyself.