Personally, I think I have changed things once or twice since I froze the configuration several months ago. Jeff LaCoursiere Network Admin UPRC Ft. You don't need to. The tripwire program and database fit nicely on a floppy disk. Regular disk drives can be flipped from ro to rw by anyone who gets root on your system.
Floppies have a convenient hardware mechanism.
Yes, updates are a problem. Not so much so if you only tripwire files that shouldn't change eg binaries, config files, authorization lists. We seem to be getting close to saying that we need authentication, non-repudiation, proof of delivery. This way everything is wide open, no boundries or firewalls, but everything is checked. This is a way to bypass a firewall.