Re: review host based intrusion detection sytems

[Keegan Quinn <kquinn@respond2.com>]

On Saturday 21 June 2003 10:24 am, Dan MacNeil wrote:
> Doing an apt-cache search on "tripwire" and "intrusion"
>
> I came up with these packages:
>
> 	aide
> 	bsign
> 	fcheck
> 	integrit
>
> I've googled around a bit but haven't found much evaluation...
>
> Does anyone have opinions on them?

I've recently (6 months ago) switched from Tripwire to AIDE.  Very happy with 
it - simple rules file syntax, very easy to use, excellent packaging.

 - Keegan