Free monitoring security system software for linux

The Network Security Monitor Daemon is a lightweight network security monitor for TCP/IP LANs. It will capture certain network events and record them in a relational database. The recorded data is available for analysis through a CGI-based interface.
You can run test version with ./Monitord, just to see how it works. Production version should be run in background, v.g. with nohup ./monitord &. Both versions will accept a device name as a parameter (default: eth0). You can send them SIGHUP at any time to print some stats. If you send SIGTERM, SIGQUIT or SIGINT, all threads will end gracefully.
Enhancements:
- Linux Kernel with "packet sockets" and "socket filtering" support.
- GNU C Library 2 (glibc2) with LinuxThreads support. (integrated in most recent versions).
- Full MySQL, including headers and libmysqlclient_r.
- GNU C Compiler (gcc).
- GNU Make (make).
- Perl (perl).
- Wget (wget).
Enhancements:
- Added chmod 4755 ... in Makefile
- Root should run make now, but not the daemon ;-)
- The daemon will drop root privileges as soon as possible
- (after creating the raw socket with an attached linux socket
- filter and putting the interface in promiscuous mode)
- No threads run with root privileges so its much safer
- (specially the new server thread which reads remote user input)
- Added stats thread
- To calculate/mantain exponential averages
- Added server thread
- It accepts HTTP requests and serves stats in XML

Fast Secure File System exports existing directories securely over the network, letting users store and retrieve encrypted data in a scalable and transparent way. FSFS is written in C and works on GNU/Linux systems on x86 and PPC architectures, with help from FUSE and OpenSSL.
File systems are easily the most evident, from the point of view of users, component of an operating system. Through file systems it is possible to organize data in a wide variety of ways, and access resources through a common interface.
Users can nowadays not only store and retrieve documents, but also find information on running processes and system settings (through ProcFS), access and manipulate e-mail (for example with GmailFS), or perform several other operations.
In several circumstances and scenarios it is desirable to protect stored files and directories from manipulation by unknown or malicious users: financial or health-related data, confidential documents, or any kind of personal or sensitive data may need to be stored securely, in such a way that it can not be examined or modified freely by third parties.
Most file systems do not take action in this sense, and external cryptographic utilities are sometimes employed to secure data before storage. While this can be a perfectly secure solution, it is not transparent to users.
Distributed file systems propose efficient ways of accessing data remotely as if it resided on the local machine; when it comes to dealing with securely stored data as in the examples above, care must be taken to preserve confidentiality and integrity also during network transfer.
Not all distributed file systems accomplish this task, weakening the overall security of the system, or do so inefficiently, making it inconvenient for users.
FSFS is a secure, distributed file system in users space, written in C with much help from FUSE and OpenSSL. It lets users store and retrieve data securely and transparently, knowing that it is protected both on permanent storage devices and while in transit over the network.
It is also concerned with scalability, therefore separates data cryptography from the server, leaving it to the clients; this approach is similar to the one used in CFS, and opposite to those taken on by other secure file system solutions (like NFS on top of IPsec).
FSFS is written as a pair of user space daemons that act as client and server. Because of this, it needs no kernel support (unlike NFS over IPsec), save the FUSE loadable kernel module on clients, included in Linux since 2.6.14; servers dont use FUSE and depend only on user space OpenSSL libraries.
Servers export an existing file system (of virtually any kind) to clients over the network through two separate channels: a TLS connection set up with OpenSSL, and a clear channel. Requests from the clients to the servers are sent via the TLS socket, thus they are encrypted and authenticated, according to TLS v1 specifications, by the channel itself and decrypted on receipt, as they are usually very short and the relevant cryptography does not constitute a great overhead; simple server replies undergo the same process.
Cryptography in this case happens at both ends of the transmission.
In a distributed file system, large amounts of data may be transferred between clients and servers, thus encrypting and decrypting everything may become too cumbersome for both parties, and as more clients are added to the system the server may severely lose performance; moreover, file data should be stored encrypted anyway, so the cryptography could be moved to the clients, in such a way that each encrypts data before a write operation sends it over the network to the server, and decrypts it after a read retrieves it.
This way servers only deal with TLS details and can concentrate on serving client requests by doing the relevant I/O on the underlying, "physical" file system. As the data is already encrypted, it does not need to go through the TLS channel and the corresponding overhead, but can be sent via the clear channel, provided the messages are authenticated.
Enhancements:
- This release fixes two bugs. One bug related to socket creation and would cause problems on some systems (namely OpenSUSE 10.2). The other bug related to server configuration creation when using the Python configuration utilities. Users dont need to upgrade to this release if theyre not experiencing problems or are not using the Python configuration utilities.

Remote Monitoring Agent (RMA in short) is an auxiliary application for HostMonitor. Enterprise license for Advanced Host Monitor already includes license for 10 installations of the agent. Holders of a Lite, Standard or Professional licenses may buy an additional license for Remote Monitoring Agent separately.
HostMonitor 4.0+ can monitor remote networks using Remote Monitoring Agents (RMA). RMA is small application that accepts requests from HostMonitor, performs test and provides information about test result back to HostMonitor.
Why you may need RMA? Here are just several reasons:
RMA increases security of the network. When you have to run the tests such as CPU Usage test or Performance Counters tests on a remote Windows system, HostMonitor must be able to log in to that system with administrators privileges. Instead you may now use an agent installed on that remote system. In this case HostMonitor will not have to log on to that system at all. HostMonitor needs just one TCP port to communicate with the RMA agent (by default it uses #1055 port, however you may set an agent to use any other port).
Remote Monitoring Agent is also a very useful tool when you have to monitor two (or many) separated networks (connected through Internet). In this case installing just one instance of RMA behind the firewall in network "A" will allow to monitor entire network "A" using the HostMonitor located in the network "B" with just one open TCP port.
RMA decreases the network traffic. E.g. frequent use of "File Integrity" or "Compare Files" tests in an array of remote systems may apply significant load on the network. The more and the bigger files you test the more traffic increase you get. RMA runs locally and sends only the test results to the HostMonitor thus decreasing the amount of network traffic.
Remote Monitoring Agent simplifies network administration. You no longer need to share local drives/folders to perform tests such as File Integrity, Folder/File Size, File Availability, Count Files, etc
RMA for Linux / BSD / Solaris allows you to perform tests that HostMonitor cannot perform. For example HostMonitor cannot monitor processes that are running on Linux systems. RMA can do that.
Main features:
- All traffic between Remote Monitoring Agents and HostMonitor is encrypted.
- It is possible to customize the list of enabled tests for each of the agents (e.g. living only Count Files and UNC tests only).
- You can restrict incoming TCP connections with the list of acceptable addresses.
- With RMA Manager you may configure, restart and even upgrade agent(s) remotely.

Ubuntu Security Notice Monitor is a karamba theme that displays the ten most recent USN report titles in a desktop widget.

Ubuntu Security Notice Monitor works by parsing the link text out of the USN page at http://www.ubuntulinux.org/usn using a Python backend.

Thanks goes to Richard "Ricardo" Szlachta for the graphics work.

Pandora are a Free Software set of programs, set under the GPL license, that allows to analyze in a visual way status and performance of several parameters from different Operating Systems, servers, applications and hardware systems as Firewalls, Proxies, Data Bases, Web Servers or Routers. All integrated into an open and distributed architecture.

Pandora can be deployed in every Operating System. You have an agent for every platform. Pandora can monitor hardware systems with TCP/IP Stack, as load balancers, routers, switches, printers and so on.

Pandora has six components: Pandora Data Server, Pandora Network Server, Pandora SNMP Console, Pandora Agents, Pandora Database and Pandora Web Management System (Web Console).

Pandora Servers and SNMP Console

They are the recipient of bundles of information and the generators of alerts; they are the brain of the system. We can have several servers for very big systems or a single server. They are developed in Perl and works under any platform, with the required modules. Nevertheless its "official" platform is GNU/Linux. They also insert the gathered data into the Database. You can have several Pandora Servers connected with the same Database.

Pandora Web Console

It allows to manage the system and to operate with it; its the user interface of Pandora. We can have several Web Consoles in the same implantation. It is developed in PHP and leans on a Data Base and a Web Server, being able to work in any platform: GNU/Linux, Solaris, Win2000, AIX and others.

Pandora Database

Core module of Pandora (as you can see in the architecture overview). In this database resides all the information of the enterprise, for example, all data gathered by agents, all configuration defined by administrator, all events, incidents, audit info... At this moment, only MySQL DataBase is supported. More Databases in the future.

Pandora Agents

They can monitor any numeric parameter, boolean states, strings or numerical incremental data and/or condition. They have a centralized architecture based on lightweight design for agents (shellscript, wsh, perl) and light agents to collect data. They support all type of platforms (Microsoft, AIX, Solaris, GNU/Linux, IPSO, FreeBSD, etc) because the agents are completely free software, and they communicate using SSH, FTP, NFS or other good way, using an XML container to transport data.

GNU Phantom.Security is a computer-controlled security system.
Phantom is designed to be a completely customizable computer controlled security system. All source code (C++/Bourne script) is included. Phantom was designed & tested on a Linux system, but I assume the C++ portions can be easily ported to other Unix systems (even DOS/Windows, maybe?). The Phantom Security system is for use with intrusion/fire detection equipment such as motion sensors, door magnets, and smoke detectors. However, any Normally Open or Normally Closed device may work with little or no change to the code. All source code and diagrams included are free to use,for distributing, and to modify!
Phantom.Controller is to be used in a system with non-powered security devices, i.e. door magnets. Phantom.Controller2 is for systems with powered security devices, i.e. motion sensors & smoke detectors. Anyone with a basic knowledge of circuit design can mix and match from these two diagrams to mix powered & non-powered devices!
Enhancements:
- To compile & install Phantom.Security 1.00:
- configure
- make
- make install
- The default installation directory is /home/Phantom/security. However, this can be modified in the top-level Makefile.am (if this is changed, you need to re-run aclocal, autoconf, & automake). However, both the bindir and datadir should point to the SAME directory, or else Phantom.Security wont function correctly, because it wont be able
- to find the Phantom.conf file.
Enhancements:
- Version 1.0!!! GNU Phantom.Security is out of Beta! I have been running Phantom.Security for months straight on my machine at work and believe it is stable enough to promote it out
- of Beta!
- Created HTML & PostScript versions of documentation. Available on-line.

Homeland Security Threat Level is an extension which displays the current U.S. Homeland Security Threat Level as an icon.

Displays the current U.S. Homeland Security Threat Level as an icon in the status bar.