Tripwire [was: ethtool trojan detected by NAI]
Benjamin J. Weiss
benjamin at Weiss.name
Sat Jan 17 20:36:12 UTC 2004
On Sat, 17 Jan 2004, Leonard den Ottolander wrote:
> Hello Benjamin,
>
> > Are there any chances to switch to samhain? I believe that it's still
> > maintained, and it has some benefits over tripwire...
>
> Possibly. Never heard of it though. What are the differences? IIRC I
> read AIDE doesn't store it's checksum database encrypted (I could of
> course sign it myself). How about samhain? Do you happen to have an URL
> handy?
Sure! It's at:
http://la-samhna.de/samhain/
It supposedly will run as a hidden system process, you can name it what
you want to help hide it from rootkits. It's supposed to protect from
rootkits, loadable modules, etc.
Ben
More information about the fedora-list
mailing list