计算机安全超级工具（十八）－主机监控

Samhain

Samhain is an integrity checker and host intrusion detection system that
can be used on single hosts as well as large, UNIX-based networks.
It supports central monitoring as well as powerful (and new) stealth
features to run undetected on memory using steganography.

Main features
    * Complete integrity check
         + uses cryptographic checksums of files to detect
           modifications,
         + can find rogue SUID executables anywhere on disk, and
    * Centralized monitoring
         + native support for logging to a central server via encrypted
           and authenticated connections
    * Tamper resistance
         + database and configuration files can be signed
         + logfile entries and e-mail reports are signed
         + support for stealth operation

Homepage: http://la-samhna.de/samhain/index.html

Canonical does not provide updates for samhain. Some updates may be provided by the Ubuntu community.

 

 

 

Tripwire

Tripwire is a tool that aids system administrators and users in
monitoring a designated set of files for any changes.  Used with
system files on a regular (e.g., daily) basis, Tripwire can notify
system administrators of corrupted or tampered files, so damage
control measures can be taken in a timely manner.

 

 

Canonical does not provide updates for tripwire. Some updates may be provided by the Ubuntu community.

 

 

Logwatch

Logwatch is a modular log analyser that runs every night
and mails you the results. It can also be run from command line.

The output is by service and you can limit the output to one particular
service. The subscripts which are responsible for the output, mostly
convert the raw log lines in structured format.

Logwatch generally ignores the time component in the output, that means,
you will know that the reported event was logged in the requested range of
time, but you will have to go to the raw log files to get the exact details.

Canonical provides critical updates for logwatch until October 2010.