About:
samhain is a daemon that can check file integrity, search the file tree for SUID files, and detect kernel module rootkits (Linux only). It can be used either standalone or as a client/server system for centralized monitoring, with strong (192-bit AES) encryption for client/server connections and the option to store databases and configuration files on the server. For tamper resistance, it supports signed database/configuration files and signed reports/audit logs. It has been tested on Linux, FreeBSD, Solaris, AIX, HP-UX, and Unixware.

Release focus: Minor feature enhancements

Changes:
It is possible to store the full content of (small) files in the baseline database, which allows this release to determine what has changed in a file. A couple of bugs have been fixed, and the mount check and process check modules are supported on OpenBSD.

Author:
rainer [contact developer]

Rating:	reset 1 2 3 4 5 6 7 8 9 10
8.26/10.00 (7 votes)

Homepage:
http://la-samhna.de/samhain/
Tar/GZ:
http://la-samhna.de/samhain/samhain-current.tar.gz

Trove categories: [change]

[Development Status]		5 - Production/Stable
[Environment]		Console (Text Based), No Input/Output (Daemon)
[Intended Audience]		End Users/Desktop, System Administrators
[License]		OSI Approved :: GNU General Public License (GPL)
[Operating System]		POSIX
[Programming Language]		C
[Topic]		Security

Dependencies: [change]
No dependencies filed

 Branches

Branch	Version	Last release	License	URLs
Default	2.4.4	05-May-2008	GNU General Public License (GPL)

 Releases

Version	Focus	Date
2.4.4	Minor feature enhancements	05-May-2008 21:40
2.4.3	Minor bugfixes	05-Feb-2008 02:06
2.4.1	Major security fixes	26-Nov-2007 21:53
2.4.0	Major feature enhancements	31-Oct-2007 23:44
2.3.8	Minor feature enhancements	05-Oct-2007 06:25
2.3.7	Minor bugfixes	17-Sep-2007 20:29
2.3.6	Minor bugfixes	07-Sep-2007 09:33
2.3.5	Minor bugfixes	21-Jun-2007 18:01
2.3.4	Minor security fixes	02-May-2007 20:19
2.3.3	Minor bugfixes	03-Apr-2007 00:11

 Comments

[»] Samhain rocks da house!!!
by s k 0 0 t - Mar 21st 2001 12:59:05

This is bar none *THE* coolest integrity checker out there. I've played with every single one I can find: Tripwire, Sentinel, Aide, FCheck, Viper, etc., etc., and this is the sh*t!

Why?

1. Platform-independent (builds on just about anything)
2. Small footprint
3. Fast
4. Stealth mode (very cool)
5. Clean code (not somebody's sophomore C project)
6. Client / server mode (send reports to a central server over a secure channel)
7. Obscure Glen Danzig reference
8. Docs that don't suck and an active development community

[reply] [top]