Samhain is a daemon. It is primarily used to check the integrity of files, search the file tree of suid files, and detect kernel module http://www.aliyun.com/zixun/aggregation/16938.html ">rootkit (Linux only)." It can be used to centrally monitor the options for stand-alone or as a client/server system, strong (192-bit AES) for encrypting client/server connections and storing databases and configuration files on the server. It supports signed database/configuration files and outputs signed reports/audit logs. Tested platforms include: Linux,freebsd,solaris,aix,hp-ux and UnixWare.
Samhain 3.0.1 This version fixes the memory leak of the INotify support code as well as a potential deadlock. Errors in Suid.check and port inspection modules have been repaired and problems compiled on FreeBSD have been resolved.
Software Information: http://la-samhna.de/samhain/
Download Address: http://la-samhna.de/samhain/samhain-current.tar.gz