> My problem with the paranoid approach here is that I have to log in
> as root regular on any machine that is being monitored by the
> daily and security scripts.

# man aliases
...
# vi /etc/aliases
...

I've aliased root, postmaster, operator and a few others to my login
name.  That allows me to forward mail to one account/mailbox, but
without changing the defaults on the system.

> To adhere to "the principle of least astonishment" I still recommend to
> have all root's cron generated output end up the same place by default.

Actually, by default, cron output is mailed to the owner of the cron
job--root in this case.

-allen

-- 
  Allen Briggs - end killing - briggs@bev.net ** MacBSD == NetBSD/mac68k **
   Where does all my time go?  <a href="http://www.netbsd.org/">Guess.</a>