Forum OpenACS Q&A: Intrusion detection system

Collapse
1: Intrusion detection system
Posted by xx xx on 08/26/05 09:33 AM
Is there anybody with experience with an intrusion detection system, especially Samhain (or maybe Aide or Tripwire)?
Collapse
2: Re: Intrusion detection system (response to 1)
Posted by Vinod Kurup on 08/26/05 01:50 PM
Hi Aldert,

I use Samhain and AIDE on my little system. They do similar things, basically looking for any filesystem changes and emailing you if they find a problem. Samhain runs as a daemon and emails you instantly. AIDE runs as a cronjob as frequently as you like.

One minor issues is that Samhain issues a lot of emails (in the 100+ range) on reboot. All of those emails were going through spamassassin on my system which then really loads the system down. I fixed it by having spamassassin skip local messages sent to me.

I'm not an expert on any of these -- just set them up via the debian documentation.

Best wishes,

Vinod