On Thursday 30 December 2004 1:49 am, mnikhil m wrote: > Now I am looking at other alternative > http://www.tripwire.org/ as someone informed me that the rpm database > can be spoofed. I use rkhunter. Take a look at: http://www.rootkit.nl/projects/rootkit_hunter.html