17 Jul
2002
17 Jul
'02
09:35
On Wed, Jul 17, 2002 at 11:24:33AM +0200, Matthias Riese wrote:
Does anybody know what makes my IDS (tripwire) go off at /etc each other day? No changes otherwise. Just the directory /etc being modified. I suppose something creates and removes again a file in /etc regularly, but can't figure out what it is.
Are you using dhcp to configure your network? Do you use any dynamic dialup tools like pppd? There's pretty much code rooting around in /etc, but it's hard to tell which application did it without knowing what you're doing :) Olaf -- Olaf Kirch | Anyone who has had to work with X.509 has probably okir@suse.de | experienced what can best be described as ---------------+ ISO water torture. -- Peter Gutmann