Bugzilla Bug 47783

The samhain file integrity / intrusion detection system

Samhain is an open source file integrity and host-based intrusion detection system for Unix and Linux.
Highlights

    * Complete integrity check:

          o samhain uses cryptographic checksums of files to detect modifications,
          o can search the disk for rogue SUID executables, and
          o can detect kernel rootkits (Linux and FreeBSD only).


    * Samhain can run as a daemon process, and and thus can remember file changes - if a file is modified you will not get repetitive reports.

    * Samhain has native support for centralized monitoring via encrypted TCP/IP connections to a central server. Checksum database(s) and client configuration can be stored on the server.

    * Samhain supports logging to a SQL database (MySQL or PostgreSQL; support for Oracle and unixODBC is present, but not well tested).

    * Checksum databases and configuration files can be PGP signed.

    * Support for a stealth mode of operation.

    * For client/server installations, a web-based console - Beltane - is available as separate package.

*** This bug has been marked as a duplicate of 34243 ***