Two quick questins:

1) does it seem reasonable to set the attribute values for all the files to:

patrick@pappy > ls -l /
total 113
drwxr-xr-x 2 root root 2112 2003-05-25 19:06 bin
drwxr-xr-x 3 root root 416 2003-10-20 16:28 boot
drwxr-xr-x 29 root root 94824 2003-10-20 16:29 dev
drwxr-xr-x 59 root root 6600 2003-10-25 12:42 etc
drwxr-xr-x 10 root root 264 2003-10-24 15:12 home
drwxr-xr-x 7 root root 2832 2003-07-29 13:52 lib
drwxr-xr-x 9 root root 224 2003-07-04 14:17 media
drwxr-xr-x 6 root root 168 2003-10-25 12:16 mnt
drwxr-xr-x 8 root root 208 2003-05-25 19:00 opt
dr-xr-xr-x 99 root root 0 2003-10-20 12:29 proc
drwx------ 17 root root 600 2003-10-10 08:02 root
drwxr-xr-x 3 root root 7168 2003-07-29 13:52 sbin
drwxr-xr-x 4 root root 96 2003-05-25 18:52 srv
drwxrwxrwt 42 root root 2176 2003-10-25 14:00 tmp
drwxr-xr-x 15 root root 416 2003-09-26 19:26 usr
drwxr-xr-x 15 root root 384 2003-08-08 21:16 var

I certainly don't remember changing them to these....

2) what is the best way to get a record of people who have remotely logged into a linux box using ssh?

On a different distro I just used 'last' as a good record.

machine 233 pII running suse8.2.