>Thus, mounting a partition ro is no guarantee things can't be changed. >This is why we recommend that the Tripwire executable and database go >on removable media that has a *physical* write-protect lock that >cannot be undone in software. > yea, but it is better then nothing, amd all precautions should be taken