On Sat, 17 Jan 2004, Leonard den Ottolander wrote: > Hello Benjamin, > > > Are there any chances to switch to samhain? I believe that it's still > > maintained, and it has some benefits over tripwire... > > Possibly. Never heard of it though. What are the differences? IIRC I > read AIDE doesn't store it's checksum database encrypted (I could of > course sign it myself). How about samhain? Do you happen to have an URL > handy? Sure! It's at: http://la-samhna.de/samhain/ It supposedly will run as a hidden system process, you can name it what you want to help hide it from rootkits. It's supposed to protect from rootkits, loadable modules, etc. Ben
