Skip to content
SPECIFICTION
Get listed

Samhain

la-samhna.de

WindowsmacOSLinuxSelf-hosted
Visit la-samhna.de
Spec score 7.3 #24 of 34 in File Integrity Monitoring Software

Spec sheet

Purpose
Samhain is a file integrity and host based intrusion detection system that monitors files and logs, and detects rootkits, rogue SUID executables, open ports, and hidden processes.Read 4 Oct 2026 · la-samhna.de
Platforms
The fact sheet lists POSIX systems including Linux, BSD, Solaris, AIX, HP-UX, and Mac OS X, plus Windows 2000/XP with POSIX emulation; Windows support is tested for the agent only, not the server.Read 4 Oct 2026 · la-samhna.de
Deployment
It can run standalone on one host or monitor multiple hosts through a client/server setup with centralized logging and maintenance.Read 4 Oct 2026 · la-samhna.de
Integrations
Samhain can function as a Prelude sensor, includes a Nagios plugin, and can send messages to named pipes, System V message queues, and external programs.Read 4 Oct 2026 · la-samhna.de
Security
Samhain supports signed database and configuration files, signed reports, authenticated client connections, encrypted central logging, and stealth options.Read 4 Oct 2026 · la-samhna.de
Support
Support options include documentation, a user forum and mailing list, bug reports by contact form or email, and an inquiry option for commercial installation or maintenance support.Read 4 Oct 2026 · la-samhna.de
License
Samhain is distributed under the GNU General Public Licence.Read 4 Oct 2026 · la-samhna.de
Central management
The client/server system uses Yule to collect client reports, distribute baseline databases and configuration files, and track client status.Read 4 Oct 2026 · la-samhna.de
Database support
The fact sheet lists Oracle, MySQL, and PostgreSQL for storing client reports; it says a database is needed for the Beltane console.Read 4 Oct 2026 · la-samhna.de
Documentation and support
The project provides a user manual, FAQ, HOWTOs, user forum, and a support contact address.Read 4 Oct 2026 · la-samhna.de
File checks
It can check file checksums and metadata including permissions, ownership, timestamps, inode, and symbolic link targets.Read 4 Oct 2026 · la-samhna.de
File integrity
It can check file checksums and attributes including size, permissions, ownership, timestamps, inode, and symbolic link targets.Read 4 Oct 2026 · la-samhna.de
Latest listed release
The download page lists version 4.5.3, released October 31, 2025, and provides a SHA-256 checksum and PGP signature verification instructions.Read 4 Oct 2026 · la-samhna.de
License and release
Samhain is distributed under the GNU General Public Licence; the download page lists version 4.5.3, released October 31, 2025.Read 4 Oct 2026 · la-samhna.de
Linux monitoring
On Linux, inotify can provide immediate file change notifications, and the kernel audit system can identify the login user who changed a file.Read 4 Oct 2026 · la-samhna.de
Log monitoring
Optional log analysis supports UNIX syslog, Apache access and error logs, Samba logs, and BSD style process accounting logs.Read 4 Oct 2026 · la-samhna.de
Management console
Beltane is a separate web based PHP console for viewing client reports and updating baseline databases; it requires a Samhain client/server installation and SQL logging.Read 4 Oct 2026 · la-samhna.de
Monitoring
Optional checks cover log formats including UNIX syslog and Apache logs, Windows registry keys under Cygwin, SUID/SGID files, open ports, hidden or fake processes, mounted filesystems, and login events.Read 4 Oct 2026 · la-samhna.de
Notable limit
The fact sheet says Windows/Cygwin support is tested for the Samhain monitoring agent only, not the server.Read 4 Oct 2026 · la-samhna.de
PCI DSS
The fact sheet describes incremental checks on growing log files as supporting the PCI DSS requirement to detect changes to existing log data.Read 4 Oct 2026 · la-samhna.de
Project publisher
The legal notice names WEP e.V., Samhain Labs department, as the editorial responsibility and lists Dr. Rainer Wichmann in Lüneburg, Germany.Read 4 Oct 2026 · la-samhna.de
Tamper resistance
The project describes signed configuration and database files, signed reports, encrypted messages to the central log server, and stealth options.Read 4 Oct 2026 · la-samhna.de
Web console
Beltane is a separate web-based console that presents client reports and supports updating centrally stored baseline databases.Read 4 Oct 2026 · la-samhna.de

Where Specifiction places it

Alternatives to SamhainAll alternatives →