Tripwire is good, a bit of a pain to start with, but once you get it all sorted, it's sweet. I have a Tripwire scan that runs everynight and emails me the result. I too have no reason to suspect I've been hacked, but I like to know whenever anything changes.
Also don't forget about Snort. I haven't looked into it much, still on the todo list, but looks impressive [EMAIL PROTECTED] writes: >> Anyone use either Tripwire or AIDE? > >Aide doesn't seem to have been maintained in some 2 years or so. It >tends to segfault in some situations, I think it's when it can't open a >file for checksumming, or when there's an I/O error on one file. It >could do with some obvious improvements to its user interface. The >config file methodology is ok. > >tripwire 2 is open source and on sourceforge, I have 2.3.1 here. The >commercial version is not open source, is up to version 4, and doesn't >support Linux. > >Does anyone know of any better IDS programs than the above? > >Volker > >-- >Volker Kuhlmann is possibly list0570 with the domain in header >http://volker.dnsalias.net/ Please do not CC list postings to me. ------------------------------------------------- Hamish McBrearty MCSE MCSA Network Engineer Rangi Ruru Girls' School 59 Hewitts Road Christchurch NEW ZEALAND Ph 03 355-6099 Fax 03 355-6027 CELL 021 999770 E-Mail: [EMAIL PROTECTED] --------------------------------------------------
