Samhain is an open source file integrity and host-based intrusion
detection system for Linux and Unix. It can run as a daemon process,
and thus can remember file changes - contrary to a tool that runs
from cron, if a file is modified you will get only one report, while
subsequent checks of that file will ignore the modification as it is
already reported (unless the file is modified again).
Samhain can optionally be used as client/server system to provide
centralized monitoring for multiple host. Logging to a (MySQL or
PostgreSQL) database is supported.
===> The following configuration options are available for samhain-4.4.3_1:
ASM=on: Use optimized assembly code
DB_RELOAD=off: Enable database reload on SIGHUP
DEBUG=off: Build with debugging support
DNMALLOC=on: Enable dnmalloc
DOCS=on: Build and/or install documentation
ENCRYPT=on: Enable client/server encryption
GNUPG=off: GNU Privacy Guard support
IPV6=on: IPv6 protocol support
LIBWRAP=on: TCP wrapper support
LOGFILE_MONITOR=off: Enable monitor logfiles
LOGIN_WATCH=off: Enable watch for login/logout
MAIL=on: Enable internal SMTP mailer
MOUNTS_CHECK=off: Enable check mount options on filesystems
PORT_CHECK=off: Enable check ports
POSIX_ACL=off: Enable check posix acls
PROCESS_CHECK=off: Enable check processes
PTRACE=off: Enable use anti-debugger options
SRP=on: Enable SRP for authentication
STATIC=off: Build static executables and/or libraries
SUIDCHECK=off: Enable check for suid/sgid files
UDP=off: Enable UDP server
USERFILES=off: Enable check for users config files
XML_LOGS=off: Enable XML-formatted logs
====> Database support: you can only select none or one of them
MYSQL=off: MySQL database support
ODBC=off: ODBC database backend
PGSQL=off: PostgreSQL database support
===> Use 'make config' to modify these settings
Updating the Samhain HIDS to 2.2.0. Changes since last version:
- For files under the 'GrowingLogfiles' policy, the checksum is now
verified up to the previous size.
- Server-to-server relay is possible.
- More user policies are available now.
PR: ports/96643
Submitted by: maintainer (David Thiel)
When yule is installed, add the yule user and group as well. This is
especially useful for package users since they couldn't run the install-user
target.
PR: ports/90305 (based on)
Submitted by: David Thiel <lx@redundancy.redundancy.org> (maintainer)
Approved by: maintainer timeout on feedback (3 months)
Committed from: Sydney Linux User Group codefest at UTS
Update: security/samhain 2.0.10 -> 2.1.0
Updating the Samhain integrity checking system to 2.1.0, a
bugfix release.
It's been requested by several people to break Samhain out
into separate client and server ports. This PR does that,
with a samhain-client and samhain-server port, as slave
ports off of samhain. I'm not sure the best way to submit
a PR to do this kind of action, but here is a shar of all
three ports. If another format is desired, please let me
know. I'm also interested in feedback on the approach used
for splitting these out.
PR: ports/90305
Submitted by: David Thiel <lx@redundancy.redundancy.org>
- Update to 2.0.9
- samhainrc.sample file is chgrp'd to wheel
- RUNAS_USER now defaults to "yule" properly
- XML logging is now on by default and tunable
PR: ports/85448
Submitted by: David Thiel <lx@redundancy.redundancy.org> (maintainer)
Update: security/samhain 1.8.10b -> 1.8.11
Updating the Samhain integrity checking system from 1.8.10b to 1.8.11.
Code changes include:
o for files in the IgnoreAll policy, there are no warnings
(anymore) about 'no such user/group' and/or non-printable filenames
o there is a new option HardlinkOffset=... to specify an
offset from the canonical hardlink count for a directory
o ... and a new option AddOKChars=... to modify the set of
characters in a filename for which a warning (about
obscure/non-printable) filename is issued.
Port changes:
Turn off kernel integrity checking by default - building
this into packages wouldn't work anyhow, since it would
only work with an identical kernel as on the build cluster.
PR: ports/71169
Submitted by: David Thiel <lx@redundancy.redundancy.org>
Update to 1.8.3. See docs/Changelog for full details. Notable:
new option SetBindAddress (--bind-address=...) to force
interface for outgoing connections on multi-interface box
use persistent connection to database by default
PR: ports/62290
Submitted by: David Thiel <lx@redundancy.redundancy.org>
Update to 1.8.1, mostly minor bugfixes. See docs/Changelog for details.
PR: ports/59935
Submitted by: David Thiel <lx@redundancy.redundancy.org> (maintainer)
update security/samhain: 1.7.11 -> 1.7.12
- Updating Samhain to 1.7.12, which contains fixes for a heap overflow
in e-mail parsing.
PR: 57965
Submitted by: David Thiel <lx@redundancy.redundancy.org> (maintainer)
iUpdate of Samhain to 1.7.8
Update to version 1.7.8
Fix build when MySQL logging is enabled
Add LOG_SERVER and ALT_LOG_SERVER tunables
Require LOG_SERVER be defined for clients
Have clients request config and signatures from server by default
Change TRUSTED_USER to a more accurate name (RUNAS_USER)
Fix sample config file install/deinstall
Add documentation on tunables
PR: ports/52912
Submitted by: David Thiel <lx@redundancy.redundancy.org>
The Samhain Intrusion Detection System
Samhain is a host-based Intrusion Detection System and
integrity checker with advanced features such as centralized
logging, MySQL/PostgreSQL support, and rootkit detection.
PR: ports/46982
Submitted by: David Thiel <lx@redundancy.redundancy.org>
Number of commits found: 138 (showing only 38 on this page)
