samhain 2.3.0 review

Download

Samhain is a multiplatform, open source solution for centralized file integrity checking / host-based intrusion detection on POSIX sy

License:	GPL (GNU General Public License)
File size:	1530K
Developer:	Samhain Labs

Samhain is a multiplatform, open source solution for centralized file integrity checking / host-based intrusion detection on POSIX systems (Unix, Linux, Cygwin/Windows).

samhain project has been designed to monitor multiple hosts with potentially different operating systems from a central location, although it can also be used as standalone application on a single host.

Here are some key features of "samhain":
Centralized monitoring

Samhain clients (or agents) can connect to a central log server via secure (encrypted and authenticated) TCP connections. This allows central logging to the server, central storage of baseline databases and client configuration data, and central updates of baseline databases.

Web-based management console

For client/server installations, a web-based console - Beltane - is available as separate package. Beltane allows to monitor server and client activity, view client reports, and update the baseline databases on the server side.

Multiple logging facilities

Samhain supports multiple logging facilities, each of which can be configured individually. Supported logging facilities include (but are not limited to) tamper-resistant logfile, syslog, email, relational databases (MySQL, PostgreSQL, Oracle, or unixODBC) and the Prelude IDS.

Tamper resistance

Samhain offers PGP-signed database and configuration files, a stealth mode, and several more features to protect against attempts to subvert the integrity of the samhain client / agent.

What's New in This Release:
Checking of SELinux attributes and Posix ACLs is possible now.
Two new modules to check for hidden processes and open ports have been added, and a couple of bugs have been fixed.
Upgrading to this release requires an update of the table definition if logging to an RDBMS is enabled.

samhain 2.3.0 screenshot
Zoom

samhain 2.3.0 search tags

samhain 2.3.0: Samhain is a multiplatform, open source solution for centralized file integrity checking / host-based intrusion detection on POSIX sy
Beltane 1.0.10: Beltane project is a PHP4 (also works with PHP5) application, with some additional components written in C. PHP4 (or PHP5) may be co
ICU 0.3: ICU (Integrity Checking Utility) is a Perl program used for executing AIDE filesystem integrity checks on remote hosts from an ICU se
Fast Logging Project for Snort 1.6.0: Fast Logging Project for Snort is designed to gather alerts with payload from distributed snort sensors on a central server and to st
Performance Co-Pilot 2.5.0: Performance Co-Pilot (PCP) is a framework and services to support system-level performance monitoring and performance management.
iWatch 0.0.12: There are a number of excellent tools to check filesystem integrity, they are essential part of your system security
cosign 1.9.3: cosign is a Web single sign on system that allows users to authenticate once per session and access any protected Web resources at th

samhain 2.3.0 review

Alternative/similar