Introduction

Osiris and Samhain are two of the most widely deployed open source host integrity monitoring systems today. This chapter examines how each of these systems work and their respective strengths and weaknesses. Osiris and Samhain are very different; therefore, one of them will be more suited to your requirements than the other.

Osiris

Preston Norvell and Bruce Potter released the first version of Osiris in the summer of 1999. This release consisted of two small Perl scripts designed to provide file integrity checking for Windows NT. The popularity of these scripts paved the way for the Osiris project, which released its first version (written in C) in the fall of 1999.

At the time, open source options for file integrity monitoring were limited. Tripwire was too cumbersome to use, and many administrators found it difficult, primarily because it was not centrally managed. Thus, the Osiris project was borne out of the desire to produce a host integrity monitoring application that would do the following:

• Provide easy-to-use, centralized management

• Monitor as much of the host environment as possible

At the time of this writing, Osiris Version 4.1 monitors files, network ports, users, groups, kernel modules, and more. Information about Osiris, including the latest releases, anonymous source access, support mailing lists, and documentation, can be found at http://hostintegrity.com/osiris.