Overview

Samhain is an open-source file integrity checker and host-based intrusion detection system (HIDS) for POSIX systems, written and maintained by Rainer Wichmann at Samhain Labs. It watches the files, logs, processes, ports and kernel of a machine, keeps a signed baseline of how everything looked, and reports anything that changed without permission — a modified binary, a new setuid program, a hidden process, an unexpected listening port or a tampered log file.

Its distinguishing feature is scale: Samhain was designed from the start to monitor many hosts with different operating systems from one central place. A single agent can also run standalone on one server, but the client/server architecture — with the yule log server, a relational database and the Beltane web console — is where it shines for fleets.

Key Features

File integrity monitoring

• Checksums (TIGER192, SHA-1 or MD5) plus size, mode and permissions, owner, group, creation/modification/access times, inode, hardlink count, device numbers and symlink targets.
• Extended attributes where the system offers them: SELinux labels, POSIX ACLs, Linux ext2 attributes set by chattr (including the immutable flag) and BSD file flags.
• On Linux it can use the kernel audit subsystem to report which logged-in user modified a file, and inotify for immediate notifications instead of repeated full scans.
• Twelve predefined check policies, each fully re-definable; per-directory recursion depth, shell wildcard patterns, and explicit exclusion of files or subtrees. The userdir extension lets a rule apply across every user’s home directory in a UID range.
• Directories’ hardlink counts are verified, which reveals subdirectories hidden by kernel rootkits; small files (under about 9 KB compressed) can be stored in the baseline so you can see what changed, not just that it did.

Log file monitoring and analysis

• Parses UNIX syslog, Apache-compatible access and error logs, Samba logs and BSD-style process accounting records.
• Whitelist and blacklist policies with Perl-style regular expressions, correlated-event detection, missing-heartbeat alerts and automatic detection of message bursts.
• Incremental verification of growing log files — the data present at the previous check must not have been altered since — which is what PCI DSS section 10.5.5 asks for.

Host integrity modules

• Kernel integrity (Linux, FreeBSD, OpenBSD) to catch kernel rootkits.
• SUID/SGID scan on its own schedule, able to report, strip the privilege bits, quarantine or delete new setuid files.
• Open ports compared against an allowed/required list, reporting the owning program on Linux and FreeBSD.
• Process check for processes hidden from ps, fakes listed by ps that do not exist, and required processes that are missing.
• Mount check for filesystem presence and mount options, and login/logoff monitoring via utmp.
• Windows registry integrity checking of keys and hierarchies under Cygwin.

Logging, alerting and integration

• Log entries and e-mail reports are cryptographically signed; messages to the central server are AES-encrypted and the client must authenticate.
• Facilities: log file, syslog, console, e-mail (with per-recipient filters), central yule server, MySQL/PostgreSQL/Oracle, or an external program fed on stdin.
• Active response: external programs can be executed on chosen events — reconfiguring a firewall, restarting a service, rebooting the box.
• Ships a Nagios plugin (check_samhain.pl), can compile against libprelude to act as a Prelude sensor, and exposes a named pipe and a SystemV message queue for other tools.

Tamper resistance

• GnuPG-signed baseline database and configuration file, an embedded connection password, and a unique random 64-bit key compiled into each build so reports from a rogue binary fail verification.
• Daemon mode leaves a recognisable mark on stop/restart, and stealth options (including a Linux hiding module) make the agent hard for an intruder to find and subvert.

Why Use It

Most file integrity tools answer one question: did this file change? Samhain answers that on hundreds of hosts at once, keeps the baselines centrally so a compromised client cannot hide its own tampering, and folds in log monitoring, rootkit, setuid, port and process checks that would otherwise need several separate agents. Its signed reports and stealth mode are aimed squarely at the case where the attacker has already got root — the point at which naive monitoring stops being trustworthy.

Use Cases

• Fleet-wide integrity monitoring for hosting providers and internal estates: one yule server holding baselines and configs for every client.
• PCI DSS compliance — file integrity monitoring plus incremental verification of growing logs.
• Incident response: drop the agent on a suspected host, baseline it, and diff the machine after a compromise.
• Change auditing on configuration files and binaries where an unexplained edit is itself the alarm.
• Hardened single servers that need rootkit and setuid detection without a full SIEM.

Supported POSIX systems are Linux, the BSDs, Solaris 2.x, AIX 5.x, HP-UX 11 and macOS; the agent alone — not the server — also runs on Windows 2000/XP under POSIX emulation such as Cygwin. Debian and its derivatives package it as samhain.

Licence

Open source — GNU General Public License, version 2 or later. The download page states plainly: “Samhain (‘the software’) is distributed under the terms of the GNU General Public Licence (GPL)”. The Debian copyright file records the grant as “either version 2 of the License, or (at your option) any later version”. The current release is 4.5.3, published as a signed source tarball. The optional Beltane II console is a separate commercial product; the free Beltane I console ships as its own package.

Alternatives

• AIDE — the Advanced Intrusion Detection Environment, a lighter single-host file integrity checker.
• Tripwire — the original file integrity monitor.
• Wazuh — a full open-source SIEM/XDR platform with file integrity monitoring built in.