Host Based Intrusion Detection - Samhain

[ Thanks to Falko Timme for this link. ]

"This article describes in some detail how to install Samhain, the host based intrusion detection system. For further information regarding Samhain, please see http://www.la-samhna.de/samhain/

"I am not going to ramble on about what host based intrusion detection is or why to use it, as there are plenty of articles already covering those subjects. This article is just to show you how to get Samhain up and running in a client / server configuration with a couple bells and whistles thrown in for fun.

"I highly recommend you read the entire guide before you start, it will most certainly help.

"There is a lot of swapping between client and server as I try my best to confuse you, so stay sharp!

"Prerequisites

"You will need all the required build tools installed as we are going to compile Samhain. Here is a quick refresher:

"Red Hat

yum groupinstall "Development Tools"

Complete Story

Related Stories:

• Fwsnort: Application layer IDS/IPS with iptables(Jan 12, 2011)
• Metasploit Takes Aim at Cisco Insecurity(Dec 18, 2010)
• OSSEC: the Open Source Host Intrusion Detection System(Dec 07, 2010)
• OSSIM: the Open Source Security Information Manager(Dec 01, 2010)
• A Simple Snort Alert Parser(Sep 27, 2010)