I spent a little bit of time on the spec ...
Tripwire will not interfere with system files, seems to make a complete picture of system files at a given time then just trigger reports in case of undue modifications.
At worst it would trigger an avalanche of alarms and take months to adapt the script to eliminate false positives.
I will try as soon as I have a few days.
Would you recommend another IDS which you tried already ?
To perfprm installation tests I would like to virtualize a second server on the first one,
any recommendation ?
(should I open a specific thread on virtualization ?)
Thanks and regards,