Tripwire [was: ethtool trojan detected by NAI]

[Benjamin J. Weiss]

On Sat, 17 Jan 2004, Leonard den Ottolander wrote:
> Hello Benjamin,
> 
> > Are there any chances to switch to samhain?  I believe that it's still
> > maintained, and it has some benefits over tripwire...
> 
> Possibly. Never heard of it though. What are the differences? IIRC I
> read AIDE doesn't store it's checksum database encrypted (I could of
> course sign it myself). How about samhain? Do you happen to have an URL
> handy?

Sure!  It's at:

http://la-samhna.de/samhain/

It supposedly will run as a hidden system process, you can name it what 
you want to help hide it from rootkits.  It's supposed to protect from 
rootkits, loadable modules, etc.  

Ben