From owner-freebsd-security Tue Jan 25 9: 0:14 2000 Delivered-To: freebsd-security@freebsd.org Received: from altair.origenbio.com (altair.origenbio.com [216.30.62.130]) by hub.freebsd.org (Postfix) with ESMTP id 4FFA415741 for ; Tue, 25 Jan 2000 09:00:04 -0800 (PST) (envelope-from dmartin@origen.com) Received: from origen.com (dubhe.origen [192.168.0.5]) by altair.origenbio.com (8.9.3/8.9.3) with ESMTP id KAA72962 for ; Tue, 25 Jan 2000 10:59:50 -0600 (CST) (envelope-from dmartin@origen.com) Message-ID: <388DD63F.A28F831F@origen.com> Date: Tue, 25 Jan 2000 10:58:39 -0600 From: Richard Martin X-Mailer: Mozilla 4.7 [en] (WinNT; U) X-Accept-Language: en MIME-Version: 1.0 To: freebsd-security@freebsd.org Subject: Tripwire dates Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Anyone know if there is a flag that needs to be set to allow Tripwire to pass the file date information into its report? I have used both the ports version and compiled it myself from COAST, but daily reports from both versions show a "(null)" entry like changed: -rw-r--r-- root 1351 (null) /etc/rc.conf changed: -rw-r--r-- root 9 (null) /etc/ntp/drift where the date should be. TW running on other platforms prints in the file date like changed: -rw-r--r-- root 16384 Jan 13 18:14:05 2000 /etc/aliases.db changed: -rw-r--r-- root 9 Jan 25 02:02:36 2000 /etc/ntp/drift which is helpful in determining legal file modifications. -- Richard Martin dmartin@origen.com OriGen Biomedical Tel: +1 512 474 7278 2525 Hartford Rd. Fax: +1 512 708 8522 Austin, TX 78703 http://www.cardiacdocs.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message