K, tripwire is reporting tha my pam_pwd.so module has a different modify time than expected. The modules file itself is empty, and I am having a hard time finding out what that module is used for. I have a good feeling that I am the one that caused the mod time to change, however I can't think of what I may have done to do this? The system is working just fine, but tripwire is complaining. Also does anybody know of some good online PAM resources, for things like modules definitions etc...

I Appreciate Any and All help!
Mike.

If only the modify time (for that inode) has changed, and nothing else, that's weird. No size changes, etc? Plus I can't believe a .so to be emtpy...

Anyway, about module/params/etc info, check LP-SAG, the Linux-PAM System Administrators' Guide...

All tripwire reports is that the modify time has changed, and when I look at the file it is empty. There are no other indications of fowl play, so that's kinda why I thought it would be me.

Thanks For the Response!
Mike.