Tripwire, AIDE, and Samhain

• All are host-based / file-based IDSs (HIDS/FIDS) (file integrity checkers)

• Check to see what files (and file attributes) have changed

• Simple, easy to use and set up

• Tripwire is included in most Linux distributions; an Enterprise (commercial) version of Tripwire is also available

• CVS-based approach at www.linuxjournal.com/article.php?sid=5569