F-SECURE ANTI-VIRUS LINUX SERVER SECURITY Administrator's Manual page 66

64
do not enable the Kernel Module Verification during the installation, you
have to generate the baseline manually before Integrity Checking is
enabled.
All files that are added to the baseline during the installation are set to
Allow and Alert protection mode.
Passphrase
The generated baseline has to be signed to prevent anyone from
modifying the protected files.
The product verifies the baseline and the system integrity
cryptographically. A cryptographic algorithm is applied to the baseline
contents and the passphrase to generate a signature (a HMAC signature)
of the baselined information.
IMPORTANT: You must take great care not to forget the
passphrase used as it cannot be recovered and the baseline
cannot be verified against tampering without using the same
passphrase.
You should not share the passphrase with other administrators without
fully understanding the consequences. Other administrators could tamper
with the baseline and regenerate it using the same passphrase, and the
subsequent check would appear to be all right.
Command Line
For information how to create and check the system integrity from the
shell, see "fsic", 75.