    To automate s()'s  integrity scans, a file
tt(/etc/cron.d/stealth) could be created, containing a line like
        verb(
    2,17,32,47 * * * *  root    test -x /usr/bin/stealth && \ 
                           /usr/bin/stealth /root/stealth/client.pol
        )
    This starts s() 2 minutes after every hour. In this example the ssh-key
must not require a passphrase, as bf(crontab)(1) cannot provide passphrases of
ssh-keys. Ssh-keys requiring passphrases can, however, be used if repeated 
s() runs are controlled  by a program like bf(ssh-cron)(1).

    In general, randomized events are harder to notice. For this s() offers
the tt(--repeat) and tt(--random-interval) options. Both options expect an
argument in seconds (or in minutes, if an tt(m) is appended to the
specification). After each integrity scan the next integrity scan starts after
the time interval specified by the tt(--repeat) option plus a random time
value selected from the time interval specified by the tt(--random-interval)
option. For example, the s() daemon started by the following command
repeatedly performs integrity scans between two and five minutes after the
last integrity scan completed:
        verb(
    stealth --daemon /root/stealth/client.uds \ 
            --repeat 2m --random-interval 3m /root/stealth/client.pol)
    Once this program has started its bf(ssh)(1) connection to the client host
persists, and a possibly required ssh-passphrase is no longer
required. Additional (intermediate) integrity scans can always be requested
(also without requiring ssh-passphrase specifications) using the command
        verb(
    stealth --rerun /root/stealth/client.uds)

