Free smbd audit software for linux

NiX - WVS is a tool for webmasters to audit their website security.
Main features:
- Full multithreaded engine everywhere
- Supports atm. max. 10 proxies (Will use random proxy for every request. Of course site audit can be done without any proxy as well.
- You can configure how many threads will be used for each Module
- Uses a ramdisk for better performance
- Very customizable, you can define timeouts, misc options like Useragent and so on
- Easy customizable modules, very easy to add new dir/file checks and for example new LFI/RFI bugs etc...
- Current modules =>
- Full site crawler
- Directory and filechecks (Also nested Dir/File checks can be defined to be done)
- xScan attack database (Uses Milw0rm vulnerabilities, several hundreds already added but need still lot of work...)
- Parameter manipulation engine supports atm. only Local File Inclusion and Remote File Inclusion tests. Much more will be added like SQL Injections/XSS/CRLF Injects/Cookie manipulation and so on...
- It have also nice logic like if there was not anything to crawl, it wont do nested directory checks even you defined it do that and so on.

SNARE (System iNtrusion Analysis and Reporting Environment) is a kernel patch, daemon, and Gnome2 GUI, that together provide a host intrusion detection facility and C2-style auditing/event logging capability for Linux similar to the Basic Security Module (BSM) for Solaris, or the Windows Event Log.
SNARE is divided into three key components:
The Kernel changes
In order to collect event log data, Snare needs to add auditing support into the operating system. You can choose to either install a binary version of the kernel, with Snare already integrated, or you can apply a patch to your kernel source.
Although we try hard to make Snare as easy to install as possible, there are hundreds of different distributions and kernel versions, and it would be an immense task to build Snare for each variant. We are hoping that recent efforts towards creating a native auditing subsystem for linux will soon mean that the kernel component of the Snare for Linux agent, will no longer be required.
The Snare Audit Daemon
The Snare audit daemon acts as an interface between the Linux kernel, and the security administrator. It allow you to turn on events, filter the output, and potentially push audit log information back to a central location for collection, analysis and archival.
The Snare Micro-Web Server, and Audit GUI
The Snare audit GUI provides a graphical user interface to the Snare audit daemon. It allows you to add, remove or modify audit objectives, and change reporting options.
The Micro-Web Server, is embedded in the audit daemon, and provides a very simple configuration capability that can be managed from your web browser.
Enhancements:
- Added support for compound matching elements (e.g. name=/etc/* name!=/etc/blah/*)
- Improved authentication support for remote control interface
- Updated SELinux policy (RHEL5 support)
- Improved automatic audit configuration using objective returncode detection to pre filter unnecessary records
- Fixed element matching error
- Fixed error in criticality reporting (e.g. criticality was always zero)
- Fixed race condition that could potentially clear all audit rules on restart
- Improved effeciency allowing a higher throughput
- Improved installer for easier deployment
- Disabled local logging by default

Config::Model provides a framework to help in validating the semantic content of configuration data. The project can also be used to provide a semantic check of options of a complex program like mplayer or transcode.
For most complex software, configuration upgrade is a difficult task for most people. By using Config::Model, a software can provide a smooth upgrade path for their users.
How does this work ?
Using this project, a typical configuration validation tool will be made of 3 parts :
The user interface
The validation engine which is in charge of validating all the configuration information provided by the user.
The storage facility that store the configuration information
Dont we already have some configuration validation tools ?
Youre probably thinking of tools like webmin. Yes, these tools exist and work fine, but they have their set of drawbacks.
Usually, the validation of configuration data is done with a script which performs semantic validation and often ends up being quite complex (e.g. 2500 lines for Debians xserver-xorg.config script which handles xorg.conf file).
In most cases, the configuration model is expressed in instructions (whatever programming language is used) and interspersed with a lot of processing to handle the actual configuration data.
Whats the advantage of this project ?
The Config::Model projects provide a way to get a validation engine where the configuration model is completely separated from the actual processing instruction.
The configuration model is expressed in a declarative form (i.e. a Perl data structure) which is always easier to maintain than a lot of code.
The declaration specifies:
the structure of the configuration data (which can be queried by generic user interfaces)
the properties of each element (boundaries, check, integer or string, enum like type ...)
the default values of parameters (if any)
mandatory parameters
the targeted audience (intermediate, advance, master)
on-line help (for ach parameter or value of parameter)
the level of expertise of each parameter (to hide expert parameters from newbie eyes)
So, in the end:
maintenance and evolution of the configuration content is easier
user will see a *common* interface for *all* programs using this project.
user will not see advanced parameters
upgrade of configuration data is easier and sanity check is performed
audit of configuration is possible to check what was modified by the user compated to default values
What about the user interface ?
Config::Model will also come with a Curses::UI interface that queries the users model and generate the relevant user screens.
What about data storage ?
Since the syntax of configuration files vary wildly form one program to another, most people who want to use this framework will have to provide a dedicated parser/writer.
Nevertheless, this project can also provide a writer/parser for most common format: like ini style file, or provide an interface to the Elektra or debconf projects. This point is open for discussion.
It is entirely possible for a single configuration model to use several parsers and writers so one model will ensure the consistency of several configuration files together.
Enhancements:
- The Xorg model was updated to Config::model version 0.609.
- Some bugs were fixed.

Twisted Packager II (TP2) is a package manager that aims to make live easy - for end users and also developers. In some respects it is similar to Autopackage - it does not intend to replace the "system packaging tool" but instead will sit alongside it to allow application developers an easy way to package software; and system administrators an easy way to install [or remove!] such software.
TP2 excels at handling generic software - and allows a "source" type package [such as itself!] to be installed across multiple architectures and operating systems using the same package.
TP2 is cross-platform; it is currently in use on Solaris, Linux and HP-UX. Soon the intention is validate it also for BSD and AIX.
TP2 is flexible. It supports dependency management, package verification, preview installation and removal, and audit logs all activity.
TP2 is powerful. It supports "namespaces" which allows the same packages to be installed into different areas on the same machine. Non-root users can be given areas which they can manage independently.
Enhancements:
- Initial public announcement, though the software has been in use in several environments for over 12 months.

Bugzero is a web-based bug tracking, defect tracking, issue tracking, and change management system used in a distributed team environment to track software bugs, hardware defects, test cases, or any other issues. Bugzero can also be used equally well as a helpdesk customer support, trouble ticketing, or email management system to collect and manage customer feedbacks, incidents, requests, and issues.
Bugzero provides a cost-effective enterprise-grade solution to increase team work efficiency. It is easy to use, but still flexible and adaptive, and can be configured to fit to your organizations unique business process and workflow. Bugzero empowers you and puts you in full control, and allows you to accomplish your tasks in the best way possible.
Main features:
- Open standards technology, web-based, lightweight, feature-rich, robust, fast, reliable, and a high level of usability
- No client software, no firewall issues, and accessible from anywhere on the internet through HTTP or SMTP
- Support both web interface and email interface (particularly for customer support), for internal and external users
- Single system with one code base, minimal system requirements and maintenance, easy install (server side only)
- Operating system independent, based on Java and J2EE, truely run anywhere and everywhere
- Cross database systems, based on standard SQL 92, fully open, scalable, and modular database schema
- More than just bug tracking, works equally well as a help desk customer support system
- Support custom fields of data types including datetime, number, URL, and link ID. Fields can be added or removed anytime.
- Configurable page layout, company logo, and look and feel
- Support multiple projects, configurable access control, and self registration
- Configurable advanced group and field level access control model (security)
- Completely configurable and customizable workflow (defect tracking lifecycle)
- Configurable automatic and manual bug-assignment
- File attachment (can attach multiple files and any kinds of files at once)
- Email notification and cc mail (per project, template based)
- Configurable email notification triggers or listeners (per project, per user)
- CVS and Perforce source version control integration through email
- Metrics reports, advanced search, and re-usable stored queries
- Comprehensive readable bug-audit trail (change history)
- Quick sorting and CSV file export supporting Asian languages in Unicode
- Public projects and self registration for open source projects
- Support internationalization with Unicode (UTF-8)
- Support LDAP/Active Directory user authentcation (available as add-on)
- Custom email reminder and escalation (available as add-on)
- Easy to use web-based system administration (no learning curve)
- Exceptional remote trouble shooting and debugging capabilities
Version restrictions:
- Hardware: PC, Mac, Sun, or IBM Servers, more
- OS: Windows, Unix, Linux, or Mac OS, more
- Server Database: Oracle, DB2, SQL Server, Sybase, MySQL, PosgreSQL, or Access, more
- Server Software: JDK1.3+ and a Java application server such as Tomcat, WebLogic, WebSphere, more
- Client Software: MSIE, Mozilla, FireFox, Opera, or Netscape, more
Enhancements:
- The two issues when upgrading using Sybase, an error in "DROP PRIMARY KEY", and the need to set "ddl in tran" to true for the tempdb have been fixed.
- A JSP compile error in help.jsp with IBM WAS was fixed.
- Email parsing for field name was improved. The users drop-down fields are now filtered if the login user is in a controlled user group, and only users in the same group are listed.

OpenXDAS is an open source implementation of the OpenGroups Distributed Auditing System. The XDAS standard was defined in 1998 by an OG working group with representation from several software companies supporting various flavors of Unix and other operating systems.
XDAS was never taken beyond preliminary specification - probably due to a general lack of enthusiasm in the world on the subject of auditing. Nevertheless, XDAS was designed by experts in the field of auditing and security-related logging services.
Enhancements:
- Added netstream logger. Currently the netstream logger allows you to send clear text formatted as CRLF-terminated lines to service listening on a configured port number on a local or remote server. Eventually, this service will also support generic SSL connections using openssl.
- Fixed a number of oversights in the Windows MSI installer. Missing files added, versioning corrected, etc.
- Added a new library that allows an application to link statically to a very small stub library which dynamically loads and initializes the actually libxdas instrumentation library. This feature allows an application to consume, but not depend on the existence of the OpenXDAS service.

Nuxeo EP (Enterprise Platform) is the server-side, Java EE-based part of the Nuxeo Enterprise Content Management platform.

Nuxeo EP project provides a framework and set of components to address document management and collaboration needs, including metadata/taxonomies, lifecyle management, workflow, relations, versioning, searching, reporting, transformation, auditing, and retention.

Its flexible extension system, based on OSGi, allows developers to quickly configure and extend the platform by creating new components. Its default Web user interface, based on the JSF standard, uses AJAX to create a pleasant user experience. It can also be accessed by a rich client interface through the use of Web services, for instance using the Eclipse-based Nuxeo RCP rich client platform.