This is a hack, but it will get the job done. You could setup your tripwire policy so that it will always generate an error of some sort. That way you would always get a message, and if you failed to get an error sent, then you would know that your system has been fooled with. There are ways to defeat this, i.e. your hacker could figure out the error you were sending yourself and mimic that, but it would work until you can get a more robust solution in place.
Good luck! - Phil -----Original Message----- From: Caldera OpenLinux Benutzer [mailto:[EMAIL PROTECTED]] Sent: Wednesday, January 02, 2002 8:17 AM To: [EMAIL PROTECTED] Subject: How to ensure Tripwire is doing its job ? Hello Folks, i just installed tripwire and everythings seems to be fine. The only thing i am worrying about are fake Reports send to me. If the System is hacked and compromised between two Tripwire runs, could't the hacker stop the Cronjob and starts sending me a fake-report telling everythings fine ? I could put the /etc/crontab on a read-only media, but what would that help ? Any Hints welcome, Regards, Philipp Steinkrüger
