Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Please give a brief description for each tool.

share|improve this question

7 Answers 7

Snort

From their about page:

Originally released in 1998 by Sourcefire founder and CTO Martin Roesch, Snort is a free, open source network intrusion detection and prevention system capable of performing real-time traffic analysis and packet logging on IP networks. Initially called a “lightweight” intrusion detection technology, Snort has evolved into a mature, feature-rich IPS technology that has become the de facto standard in intrusion detection and prevention. With nearly 4 million downloads and approximately 300,000 registered users Snort, it is the most widely deployed intrusion prevention technology in the world.

share|improve this answer
2  
Is that ad copy? –  gvkv Aug 19 '10 at 13:54

Why don’t you check http://sectools.org/

share|improve this answer

Tripwire

Is an open source (though there's a closed source version) integrity checker that uses hashes to detect file modifications left behind by intruders.

share|improve this answer

OpenBSD has mtree(8): http://www.openbsd.org/cgi-bin/man.cgi?query=mtree It checks whether any files have changed in a given directory hierarchy.

share|improve this answer

Logcheck is a simple utility which is designed to allow a system administrator to view the logfiles which are produced upon hosts under their control.

It does this by mailing summaries of the logfiles to them, after first filtering out "normal" entries. Normal entries are entries which match one of the many included regular expression files contain in the database.

You should watch your logs as one part of a healthy security routine. It'll also help trap a lot of other (hardware, auth, load...) anomalies.

share|improve this answer

DenyHosts for SSH server.

share|improve this answer

For NIDS, Suricata and Bro are two free alternatives to snort.

Here's an interesting article discussing all three of them:
http://blog.securitymonks.com/2010/08/26/three-little-idsips-engines-build-their-open-source-solutions/

Have to mention OSSEC, which is a HIDS.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.