Samhain

Samhain is an open-source, host-based file integrity monitoring (FIM), multiplatform intrusion detection, and system log analysis tool engineered to provide continuous integrity auditing and tamper detection on Unix, Linux, and Windows systems. Operating in standalone mode or in a centralized client-server architecture with cryptographic communication protocols, Samhain creates an encrypted, cryptographically signed baseline database of file system attributes, including cryptographic hash digests (SHA-256 and TIGER192), file permissions, ownership, inode numbers, and modification timestamps. The system periodically audits the active file system against this trusted database to detect unauthorized modifications, added files, or missing system binaries, making it an invaluable tool for detecting covert rootkits, trojans, and malicious administrative tampering. In addition to file integrity monitoring, Samhain provides rootkit detection by inspecting system processes for hidden executables, verifying kernel module integrity, monitoring open network ports, and tracking user login activity (such as failed su attempts). With client-server encryption, stealth operation capabilities, and centralized SQL database logging, Samhain provides a lightweight, auditable host security foundation that fulfills mandatory FIM compliance standards including PCI-DSS Requirement 11.5 and HIPAA.