Here we assume that s() is run by em(root), and that root wants to
store information about the host tt(client) under the subdirectory
tt(/root/stealth/client). 

Furthermore, we assume that reports of s() integrity-scans should be sent to
the user tt(admin@elsewhere), who is only interested in receiving a short
summary of changes, as the full report can always be read at the monitor
itself. To accomplish this a small support-script was developed, filtering the
report generated by s() down to its essentials.

As the tt(sha1sum) program on the client may be compromised, it is a good idea
to start the integrity scan by transferring the client's tt(sha1sum) program
to the monitor first, to verify the integrity of that program locally (i.e.,
at the monitor), before trusting it to compute sha1sums of the client's
files. The same holds true for any libraries and support programs (like
tt(find)) that are used intensively during integrity scans.

Sha1sum checks should be performed on all setuid and setgid files on the
tt(client), and in order to be able reach all files on tt(client),
tt(root@monitor) is allowed to login to the tt(root@client) account using
an tt(ssh) connection.

Furthermore, sha1sum checks should be performed on all configuration files,
living under tt(/etc) and on the file tt(/usr/bin/find) (which is used
intensively when performing the integrity checks).

Next, the construction of the required tt(policy) file, implementing the
abovementioned requirements, is described in the following subsections.

