Hi dan,
Syscheck /home/*/.ssh, and write a rule to ignore everything im that dir, then write a rule to alert on the authorized_keys file.
Thanks for that and it works this way :-). Michael ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.
