🚀 go-pugleaf

(Mostly in response to comments by Jim Sims):

Actually, the documentation for Tripwire will recommend that it be
installed on a read-only disk or across a network on read-only media.
The program has been designed to work with read-only input and with
the program on read-only storage.  If the read-only attribute is set
in hardware, it is very, very difficult to "hotwire" the code or
database.

As far as frequency of operation, that is up to the sysadmin.  Many
alterations cannot be detected without something like this.  In some
cases (e.g., mounting file systems across a network), files can be
altered without any unauthorized login from occuring.  Tripwire will
find those kinds of access.  This will also find Unix viruses, if any
ever appear.

Tripwire doesn't run "diff" against the file contents.  It uses message
digests/cryptographic signatures on those files that the sys admin
chooses to sign.  If the sysadmin wishes to only check i-node contents
for selected files, then the signature is not performed.

A fair amount of careful thought went into the design of this.  I'm
certainly interested in hearing comments and criticisms, but it sure
would be helpful if people would wait until they know what it is they
are commenting on.  (But then, this *is* Usenet. :-)
-- 
Gene Spafford
Software Engineering Research Center & Dept. of Computer Sciences
Purdue University, W. Lafayette IN 47907-1398
Internet:  spaf@cs.purdue.edu	phone:  (317) 494-7825