Free intrusion detection software for linux

Apache Intrusion Detection Module is a simple tool to find out intrusion attempts by examining the client requests in real time.

This is a simple attempt to build an Intrusion Detection Module for Apache. It is being run at two different sites successfully but there is a performance penalty as the module intercepts all object requests and examines with the list of vulnerable CGI applications.

Issuing a simple make should do in most cases; at worst tweak with the Makefile. The make process will compile mod-id as a apache DSO module, if your server has no DSO support you will need more time...

Any suggestions and improvements are welcome.

Dynamic Taste Detection patch makes XMMS adapt its playlist randomization function to your personal taste.

Songs you dont like end up at the end of the playlist, and songs you like to hear together tend to end up next to each other.

SIDEN is a distributed network discovery tool used for intrusion detection research. The current SIDEN architecture allows you to simulate coordinated/distributed network probes by a group of attackers.

SIDEN has been tested successfully on the OpenBSD and FreeBSD operating systems. If you try SIDEN and it works on any other platform, please contact me. Yes, it sounds interesting that I havent even tested it out on the popular Linux platform. There should be little reason why it wont work on other platforms (especially UNIX variants), since its fully implemented in Perl.

Trinux is a ramdisk-based Linux distribution that boots from a single floppy or CD-ROM, loads it packages from an HTTP/FTP server, a FAT/NTFS/ISO filesystem, or additional floppies.

Trinux contains the latest versions of popular Open Source network security tools for port scanning, packet sniffing, vulnerability scanning, sniffer detection, packet construction, active/passive OS fingerprinting, network monitoring, session-hijacking, backup/recovery, computer forensics, intrusion detection, and more.

Trinux also provides support for Perl, PHP, and Python scripting languages. Remote Trinux boxes can be managed securely with OpenSSH.

Trinux gives you the power of Linux security tools without requiring a full-blown Linux install or the need to download, compile, install, and update a complete suite of security tools that are typically not found in mainstream distributions.

Trinux will boot on any i486 or better with at least 12-16 megabytes of RAM, depending on how many packages are loaded. Hardware support for many common Ethernet cards is provided in the default kerneli and additional NICs are supported via Linux kernel modules.

Trinux 0.7x/0.8x is was developed using Slackware 7.1 and supports the latest 2.2.x kernels and glibc 2.1.x. Trinux 0.8x supports Linux kernel 2.4.x. Trinux was first released in April 1998. Versions up through 0.51 were based on Debian 1.31 binaries linked against libc5. Version 0.6x was built using RedHat Linux 5.2. Trinux utilizes Busybox to replace many common UNIX utilities.

Trinux is released under the terms of the GNU Public License.

Untangle Gateway Platform is a Linux-based network gateway with pluggable modules for network applications like spam blocking, Web filtering, anti-virus, anti-spyware, intrusion prevention, VPN, SSL VPN, firewall, and more.
Enhancements:
- Bugfixes from 5.0.0-beta; this release is stable.

LEAF Bering-uClibc is the successor of the Bering distribution. Replacing glibc with uClibc a significantly smaller distribution is possible. All packages are ipv6-ready and based on the latest sources. It also provides a new and enhanced package management.
LEAF Bering-uClibc is available for download as a single-floppy-based firewall or as an ISO-image. Additionally booting from HD, CF or an USB device is supported.
The floppy image supports dhcp, ppp and pppoe connections out of the box and fits for a SOHO network demanding a stable and secure router/Internet connection. Secure remote administration is available with dropbear, a small sshd replacement.
Using the ISO image, or an USB/CF/HD boot device, you can add about 150 packages to extend LEAF Bering-uClibc with capabilities like SNMP, 6wall (an shorewall-like IPV6 firewall setup utility), VPN, Intrusion Detection, Traffic Accounting, Quagga Routing Suite, bandwith management and wireless connections, just to name a few.
Whats New in 3.0.2 Stable Release:
- This release provides a minor fix for the config/package system and updates for dnsmasq, dropbear, and shorewall.

Network Security Toolkit is a bootable ISO live CD and its based on Fedora Core 2.
The toolkit was designed to provide easy access to best-of-breed Open Source Network Security Applications and should run on most x86 platforms.
The main intent of developing this toolkit was to provide the network security administrator with a comprehensive set of Open Source Network Security Tools. The majority of tools published in the article: Top 75 Security Tools by insecure.org are available in the toolkit.
What we find rather fascinating with NST is that we can transform most x86 systems (Pentium II and above) into a system designed for network traffic analysis, intrusion detection, network packet generation, wireless network monitoring, a virtual system service server, or a sophisticated network/host scanner.
This can all be done without disturbing or modifying any underlying sub-system disk. NST can be up and running on a typical x86 notebook in less than a minute by just rebooting with the NST ISO CD. The notebooks hard disk will not be altered in any way.
NST also makes an excellent tool to help one with all sorts of crash recovery troubleshooting scenarios and situations.
Enhancements:
- We are pleased to announce the latest NST release: v1.5.0. This release is based on Fedora Core 5 using the Linux kernel 2.6.18. Here are some of the highlights for this release: the NST Web User Interface (WUI), has been greatly enhanced and cleaned up; extensive additions to managing and analyzing network packet captures; the ability to setup and manage printers; the ability to easily mount many different supported file system types; the ability to manage the NST as a file server (both NFS and CIFS); the addition of the Inprotect package (a Nessus manager); the addition of the Zabbix package (another network resource monitoring tool - similar to Nagios)....

IPAudit monitors network activity on a network by host, protocol and port.

IPAudit listens to a network device in promiscuous mode, and records every connection between two ip addresses.

A unique connection is determined by the ip addresses of the two machines, the protocol used between them, and the port numbers (if they are communicating via udp or tcp).

IPAudit can be used to monitor network activity for a variety of purposes. It has proved useful for monitoring intrusion detection, bandwith consumption and denial of service attacks. It can be used with IPAudit-Web to provide web based network reports.

Installation:

The `configure shell script attempts to guess correct values for various system-dependent variables used during compilation.

It uses those values to create a `Makefile in each directory of the package. It may also create one or more `.h files containing system-dependent definitions.

Finally, it creates a shell script `config.status that you can run in the future to recreate the current configuration, a file `config.cache that saves the results of its tests to speed up
reconfiguring, and a file `config.log containing compiler output (useful mainly for debugging `configure).

If you need to do unusual things to compile the package, please try to figure out how `configure could check whether to do them, and mail diffs or instructions to the address given in the `README so they can be considered for the next release.

If at some point `config.cache contains results you dont want to keep, you may remove or edit it.

The file `configure.in is used to create `configure by a program called `autoconf. You only need `configure.in if you want to change it or regenerate `configure using a newer version of `autoconf.

The simplest way to compile this package is:

1. `cd to the directory containing the packages source code and type `./configure to configure the package for your system.

If youre using `csh on an old version of System V, you might need to type `sh ./configure instead to prevent `csh from trying to execute `configure itself.

Running `configure takes awhile. While running, it prints some messages telling which features it is checking for.

2. Type `make to compile the package.

3. Optionally, type `make check to run any self-tests that come with the package.

4. Type `make install to install the programs and any data files and documentation.

5. You can remove the program binaries and object files from the source code directory by typing `make clean. To also remove the files that `configure created (so you can compile the package for a different kind of computer), type `make distclean.

There is also a `make maintainer-clean target, but that is intended mainly for the packages developers. If you use it, you may have to get all sorts of other programs in order to regenerate files that came with the distribution.