---------- Original Message ----------- From: Jeffrey Tadlock <redhat@tadlocks.net> To: psyche-list@redhat.com Sent: Thu, 23 Jan 2003 21:29:14 -0500 Subject: Re: Best time to install Tripwire? > On Thu, Jan 23, 2003 at 01:46:09AM -0800, Jay Crews wrote: > > I have had RH8.0 installed on my machine, and connected to the network for > > almost a month. Got sendmail, httpd, sshd, and a few other things going. > > > > If I try to set tripwire up now, is it going to be a real nightmare? > > The biggest issue here is that the box has already been connected > to a network for a month. When you run tripwire it will create > it's initial database from the files currently on your system. > Since your system has been connected to a network for a month it > is possible that the box has already been comprised making your > initial baseline invalid. ------- End of Original Message ------- Of course, something is better than nothing. Tripwire is no more difficult to setup and configure after initial install or a year later. It simply establishes a base line database and then checks for changes from that point on. As you say, if the system is clean when the base line database is created then all is fine. Maybe he should run chkrootkit 3.8 to check things. -- Psyche-list mailing list Psyche-list@redhat.com https://listman.redhat.com/mailman/listinfo/psyche-list
