Free audit software for linux

glibc-audit is a modified version of glibc for application developers who check their code with an automatic memory access checker such as valgrind, Insure++, or Purify.
glibc-audit has been audited and cleaned up so that reports from the developers use of a memory access checker are more likely to be interesting to the developer, with less "noise" from the C library itself. Typically, glibc-audit initializes all of its local variables and structs before use. Ordinary glibc uses uninitialized dummy variables that are "dont-care" to its logic but reported by the memory access checker.
Also, the r_debug.r_brk protocol has been enhanced to co-operate with a co-resident auditor. If the auditor sets .r_brk, then the runtime loader will call the auditor directly whenever a shared library event occurs.
This is much more convenient than using breakpoints. By default the old breakpoint protocol works just like before. The new protocol is binary compatible with the old on machines where a pointer to a function is the same size as an ordinary pointer. Platforms where a pointer to a function is larger (such as HP-PA RISC, Alpha processor, or PowerPC) are not binary backward compatible, and will have to increment r_debug.r_version. Exising clients (such as gdb) also will see an ignorable type mismatch error when they are built. But for now, it is worth more not to antagonize gdb at runtime on x86.
The patch modifies 91 files. Compared to glibc-2.3.2-27.9, the additional code occupies 18 more bytes of .text, and 24 fewer bytes in the .so. On a nano-scopic scale, the typical execution cost is 0 to 3 CPU cycles per affected routine; the estimated median total impact is less than 1 second per machine per day. In the case of *printf(), glibc-audit is faster than glibc because the cleaned-up source helps gcc-3.2 avoid generating atrocious code when initializing printf_spec.info for parse_one_spec() in stdio-common/printf-parse.h.
Glibc-audit was constructed by running a memory access checker on the internal testcases of glibc, then analyzing the reported errors and modifying the source. The process revealed 10 memory access bugs in glibc-2.3.2-11.9. Seven were fixed in glibc-2.3.2-27.9, two more have been fixed in CVS, and one is a design flaw that probably will not be fixed.
Predecessor patches to glibc-audit-1 were submitted to the glibc project, but those patches were ignored [user "guest", password "guest"], declined, or rejected. There is enough improvement in usability and reliability to publish glibc-audit-1 separately.
The unmodified glibc-2.3.2-27.9.src.rpm is available from RedHat mirrors. rpmbuild -ba --target i686 took about 4 hours and 2.5GB of disk space on a machine with 1.1GHz CPU, 384MB RAM, UDMA100 disk.
Enhancements:
- The patches were updated to glibc-2.4-4.
- A glibc bug that interfered with gdb stop-on-solib-events was fixed.
- On x86, x86-64, and PowerPC, the __NR_open system call was improved to avoid leaking information from the user to the kernel.

audit package contains the user-space utilities for creating audit rules. As well as for storing and searching the audit records generate by the audit subsystem in the Linux 2.6 kernel.
Usage:
Examples usage of utilities:
General:
Window 1:
./auditd
Window 2 (you dont have to have the daemon running to try this, but
enabled has to be 1):
./auditctl -s
./auditctl -a entry,always -S open
ls
./auditctl -d entry,always -S open
Identity tracking:
./auditctl -a exit,always -S all -F loginuid=2000
./auditctl -L 2000,"test uid"
Enhancements:
- Updates were made to system-config-audit. auditctl was updated to better handle watching of directories with older kernels.
- Memory leaks and an invalid free in auditd were fixed along with interpretations in auparse.

Domain Auditor project was written to audit and track accounts within a domain. This tool uses LDAP queries to a definable Active Directory server to find various definable classes of accounts.
Initially it will operate interactively, but capabilities may be added in the future to automate functions (i.e. generate reports on a scheduled basis). The installation script handles most installation chores, so setup is very straightforward.
The tool is beta status at this time, but is in being used to generate SOX reports for my employer.
Main features:
- Reports - This function will display a list of defined reports, when invoked it will generate a list of accounts from AD (via LDAP queries) the results returned will depend on what you have defined for the filter for any particular report class under Sysadmin
- Sys Admin - This function will allow you to changes the system settings for LDAP server and port, base DN, Bind DN, username and password, and the database settings (mySQL only at this time). You may also add the report class definitions and their matching LDAP filters within this module
- User Admin - This screen is used to define users for the system and their rights. Usernames are used as the primary value, and entered values are validated via LDAP queries
- Audit Logs - The system logs all changes to the information stored and this page will allow you to review the data from these logs

Spike PHP Security Audit Tool project is a tool that performs a static analysis of PHP code for security exploits.
Usage:
To install, unzip Spike phpSecAudit package.
> unzip spike_phpSecAudit.zip
Change directory to your php repository.
> cd /path/to/code/to/audit
Execute the run.php, passing the file name or directory to audit.
> php /path/to/spike_phpSecAudit/run.php test_file.php
or
> php /path/to/spike_phpSecAudit/run.php dir_name
Enhancements:
- Modified to be PHP 4 friendly.
- A few functions have been added to the knowledge base: extract, shell_exec, pcntl_exec, and exec.
- The organization of the knowledge base file (vuln_db.xml) has been slightly improved.
- The _getAllPhpFiles function may miss a few (unverified).
- The tokenizer needs to be able to differentiate between a native function call and class method call of the same name, i.e. mail() and $class->mail().

Tiquit (Tiquit Is Quality User Incident Tracking) is a lightweight, portable incident tracking and reporting system for IT support.
Tiquits aim is to provide functions typical of similar products with less overhead and a greater capacity for customization.
Main features:
- Secure Agent Logins
- Dynamic User, Location, Agent, and Incident Type Management
- Basic Email Notifications
- Incident Search
- Simple incident text search
- Incident Date searches
- Incident lookup page for users
- Incident locking
- User setup request form
- Incident Report
- User Report
- Agent Report
- Audit trail information for incidents
- More sophisticated email notification
- Graphical reports for incidents by agent, user, location, type, group, and department
- Information request form
- File attachments
- Ability to designate parent incidents, allowing group resolution/closure
- Session-based authentication
- Visual cues indicating presence of attachments and diary entries
Enhancements:
- Made user submission, search and registration requests optional.
- Default to of Moved to a web-based upgrade method.
- Added theme manager.
- Text search highlights description search keywords.
- Added "Add resolution to knowledgebase" option.
- Added ability to send attachments and diary notes in reassignment email.
- Fixed changing close datetime bug.
- Paginated user manager by letter, threshold of 5.
- Schema changes, larger attachment filenames, longer type names Improved field sizes.
- Fixed name widget, first initial bug.

MfGames.Utility is a collection of useful C# classes that have no dependencies outside of the core libraries.
The MfGames.Utility library for C# and VB.NET is a general purposes library that contains many useful functions, but requires no additional libraries outside of itself and the core.
Main features:
- Random Number Generation
- Simple Logging
- Auditing Framework
- Tiny Functions
Enhancements:
- log4net has been merged as an optional compile.
- This release adds basic vector, matrix, quaternion, and euler rotation objects.
- The Auditable framework has been enhanced to allow for nested reporting of issues.

RefactorIT project is a tool for Java developers. A developer can take source code of any size and complexity and rework it into well-designed code by means of over 30 automated refactorings.
In addition, it provides a comprehensive set of smart query functions, a graphical dependency analyzer, and over 100 quality metrics and audits that make it possible to analyze and track large volumes of code.
It may be used as a stand-alone tool or installed as an add-in to NetBeans, Sun ONE Studio, JDeveloper, and JBuilder.
Speed and flexibility, innovativeness and aesthetics, power and appeal - todays developers and software architects expect a lot from their software development tools.
Spontaneity is especially important: we all want to be able to put our plans into action quickly.
RefactorIT is the ideal development tool for people who enjoy their freedom - it is the first comprehensive refactoring and code analyses tool that goes everywhere you want to take it - no matter...
- what IDE your team is working with - by choice or force,
- what kind of Java technologies you are developing with,
- how daring your refactoring project may seem.
RefactorIT provides
- Automatic Refactoring Operations,
- Code Searches and Analysis,
- Audits and Corrective Actions,
- Metrics,
- IDE integrations,
- Full JSP support.

Tired of a broken package system after upgrading using dselect or aptitude? Buddy is a hardcore Debian package handler reduced to its essential functions. Buddy is not intended as replacement for the common Debian package manager
Buddy is a tiny, fast, and proper Debian package handler which acts as a wrapper to apt-get and dpkg.
Every command is shown before it is executed. It has the ability to backup the package setup and simulate package manipulations (dry run).
Main features:
- package maintenance (backup, diagnostic, audit, cleanup, renew, repair)
- package information (find/search, details, status, list, count)
- package manipulation (install, uninstall, remove, purge, configure)
Advantages:
- failover safe - simulate sensitive package manipulations (dry run)
- more secure - backup your package-setup to be more reversible
- faster - no packagelist loading at startup
- more transparent - every command is shown before executed
- completely shell based - no curses or other libraries needed
Enhancements:
- This is a work in progress snapshot.