Note two things about mounting system read-only: 1) on many systems, including Suns, you can "remount" a file system r/w if you are root 2) mounting something read-only still allows writing via the raw device if permissions are set incorrectly, or if running as root. Thus, mounting a partition ro is no guarantee things can't be changed. This is why we recommend that the Tripwire executable and database go on removable media that has a *physical* write-protect lock that cannot be undone in software. --spaf