I'm new to the world of managing my own web server so have been trying to keep up with the best conventions.
Tripwire is set to run every day and the findings are e-mailed to me. To be honest, when files are listed modified/added/removed I'm not sure if its some normal system process (like log files being updated) or something fishy is going on.
Could someone point me in the right direction to some reference material, or maybe take a look at some of my recent logs and tell me if anything looks suspicious?
This is an extract of my latest Tripwire report of what I was most confused about. I never edited any of these.
Modified:
"/sbin"
"/sbin/halt"
"/sbin/init"
"/sbin/poweroff"
"/sbin/reboot"
"/sbin/runlevel"
"/sbin/shutdown"
"/sbin/telinit"
"/sbin/udevadm"
Thanks so much!
