Ok. Looks like I may have a small gig doing a security audit for a company. Other than port scanning (which will be authorized, BTW), checking running services/processes, checking usernames, and the odd setuid root app, what kinds of things should a good audit be checking for? Opinions? Tool recommendations? --am