Re: mtree vs tripwire
From: Dorin H (bj93542_at_yahoo.com)
Date: Wed, 14 Jan 2004 11:17:22 -0800 (PST) To: email@example.com
--- D J Hawkey Jr <firstname.lastname@example.org> wrote:
> Hi all.
> This might seem really naive, but can mtree be used
> effectively as
> a native-to-core-OS tripwire equivalent? Would it be
> as efficient in
> terms of time-to-run and resource requirements?
Theoretically, and practical for small configurations,
> What sort of pitfalls should I be aware of?
IMHO, you can use any tool you want to compute some
"signature" for files you deem relevant. But you have
to carefully consider the scalability problem, the
problem of false/negatives (how you/your program deal
with a modified file? bin/config/data/tmp file) and so
on. Tripwire (coorect me if I am wrong, but last time
I looked it was still to be updated in FreeBSD, focus
was on "aide") is a targetted tool that helps with the
information management... probably bloated :). Like
any tool, it is up to you to decide what's useful or
> Has anyone here done this? If so, would you care to
> share your
> \__________________ \ D. J. HAWKEY JR. /
> \________________/\ email@example.com
> firstname.lastname@example.org mailing list
> To unsubscribe, send any mail to
Do you Yahoo!?
Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes
email@example.com mailing list
To unsubscribe, send any mail to "firstname.lastname@example.org"