John Ziniti wrote: [snip] > The md5sum from that last command gave me the result I > desired. Re-running prelink on /usr/sbin/lsof gives me the "foreign" > md5sum again. I guess I'll just have to prelink from now on before I > initialize tripwire. Just be aware that updating any of the shared libraries will cause a large number of binaries to change as they are re-prelinked. It might be worth turning prelinking off if tripwire is a major part of your security strategy. -- William Hooper