The Samhain host-based intrusion detection system (HIDS) provides file integrity checking and log file monitoring/analysis, as well as rootkit detection, port monitoring, detection of rogue SUID executables, and hidden processes.
Samhain been designed to monitor multiple hosts with potentially different operating systems, providing centralized logging and maintenance, although it can also be used as standalone application on a single host.
This is free and open source software.
Key Features
- Centralized monitoring – the client/server architecture allows central logging, central storage of baseline databases and client configurations, and central updates of baseline databases.
- Web-based management console is available separately – Beltane allows you to monitor server and client activity, view client reports, and update the baseline databases.
- Flexible logging – supports multiple logging facilities, each of which can be configured individually.
- Tamper resistance – offers PGP-signed database and configuration files, a stealth mode, and several more features to protect its integrity.
- The client (or standalone) part is called samhain, while the server is referred to as yule. Both can run as daemon processes.
- Cross-platform support – runs under Linux, macOS, and Windows.
Website: www.la-samhna.de/samhain
Support: User Manual
Developer: Samhain Labs
License: GNU General Public License v2.0
Samhain is written in C. Learn C with our recommended free books and free tutorials.
Related Software
| Host-Based Intrusion Detection Systems | |
|---|---|
| Wazuh | Platform used for threat prevention, detection, and response |
| OSSEC | Full platform to monitor and control your systems. |
| Falco | Cloud native runtime security tool |
| Tracee | Runtime security and observability tool |
| AIDE | Advanced Intrusion Detection Environment |
| Logwatch | Powerful and versatile log parser and analyzer |
| Samhain | File integrity checking and log file monitoring/analysis and more |
| Sagan | Multi-threads, high performance log analysis engine |
| Hades | Uses eBPF and the netlink process connector to monitor activity |
| rkhunter | Scans for rootkits, backdoors and possible local exploits |
| Tripwire | Security and data integrity tool |
| chkrootkit | Locally checks for signs of a rootkit |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.
Sounds like an interesting project or tool. However, it seems that the tool is not being maintained very well, if you take a look at the project’s user forum.
Is there anything similar or an alternative to Samhain that is still being maintained and developed? Do you know of anything?
I don’t see anything on their forums to support this.
It seems like the project is maintained, last release is May 2023.