Robert83
Mar 3 2004, 08:10 AM
Hi,
as you know tripwire is running and I've aded those few script files, to run that get-iptables , chkrootkit, systemstatus
The problem is
that under root
/root/.mc/tree
Inode number 843888 ---changed to----> 843905
/root/.mc/cedit/cooledit.macros [the file size is zero ]
[I was using midnight commander to do the stuff]
Is this normal that these things change ? or should I be worried?
Sincerely
Robert B
Robert83
Mar 3 2004, 08:13 AM
oh and btw... what is /dev/shm ? [it's 124MB in size]
Sincerely
Robert B
hughesjr
Mar 3 2004, 08:24 AM
things inside the /root directory change all the time ... I don't look in there, only at the executable and library paths like:
/boot
/bin
/usr/bin
/usr/local/bin
/sbin
/usr/sbin
/usr/local/sbin
/lib
/usr/lib
/var/lib
/etc/rc.d
and the like...
-----------------
/dev/shm is
this
hughesjr
Mar 3 2004, 08:41 AM
Actually, on the firewall machine with on GUI stuff, the /root won't change that often, so you could include it in the files looked at...
but anytime you use programs like wget, mc, links, ssh, sftp, etc. it will update the .xxxx directories/files in /root ...then you need to update the database to make it the default setting.