Excerpts from linuxchix: 13-Dec-99 Re: [techtalk] bizarre.... by Nils Philippsen at wombat.d > You won't catch added files with rpm -Va -- they're just not in the > database, so they won't get checked. You might want to find setuid/setgid Of course, the cracker could always have replaced rpm.. ************ techtalk at linuxchix.org http://www.linuxchix.org