Opensourceinfo

Conary is a distributed software management system for Linux distributions. It replaces traditional package management solutions (such as RPM and dpkg) with one designed to enable loose collaboration across the Internet. It enables sets of distributed and loosely connected repositories to define the components which are installed on a Linux system. Rather than having a full distribution come from a single vendor, it allows administrators and developers to branch a distribution, keeping the pieces which fit their environment while grabbing components from other repositories across the Internet.

DenyHosts is a script intended to help Linux system administrators thwart ssh server attacks. DenyHosts scans an ssh server log, updates /etc/hosts.deny after a configurable number of failed attempts from a rogue host is determined, and alerts the administrator of any suspicious logins.

filewatcher is a system administration tool designed to archive changes to important system files (or any interesting file) and to send detailed reports about changes to one or more e-mail addresses when they are detected. filewatcher is of great use in multiple administrator environments where each administrator will benefit from knowing what changes were made by others shortly after they were made. While filewatcher won't report who made a particular change (unless the change itself includes that information), the fact that multiple eyes see every change makes for a much more proactive environment. And, if an invalid change is made, correcting or rolling back to the previous version is trivial.

monit is a utility for managing and monitoring, processes, files, directories and devices on a Unix system. Monit conducts automatic maintenance and repair and can execute meaningful causal actions in error situations. E.g. monit can start a process if it does not run, restart a process if it does not respond and stop a process if it uses to much resources. You may use monit to monitor files, directories and devices for changes, such as timestamp changes, checksum changes or size changes. You can also use monit to monitor remote hosts; monit can ping a remote host and can check port connections and protocols.

moodss is a graphical monitoring application. It is modular so that the code accessing the monitored objects is completely separate from the application core. The core takes care of managing modules (loading and unloading), displaying modules data through sortable tables and diverse graphical viewers, handling user set threshold conditions with email alerts, recording and browsing data history from a database. moodss can even predict the future, using sophisticated statistical methods and artificial neural networks, and therefore be used for capacity planning. The graphical user interface is complete with context sensitive help (through balloons and a message area) and features a thorough and very intuitive drag'n'drop scheme for ease of operation. Finally, dashboards created with moodss can also be used by the companion moomps daemon, for storing module data cells history over time in a database (MySQL, PostgreSQL, DB2 and ODBC compatible), thresholds and UNIX syslog monitoring in the background.

Prelude is an Hybrid IDS framework, that is, it is a product that enable all available security application, be it opensource or proprietary, to report to a centralized system. In order to achieve this task, Prelude relies on the IDMEF (Intrusion Detection Message Exchange Format) IETF standard, that enables different kinds of sensors to generate events using an unified language. Prelude benefits from its ability to find traces of malicious activity from different sensors (Snort, honeyd, Nessus Vulnerability Scanner, Samhain, over 30 types of systems logs, and many others) in order to better verify an attack and in the end to perform automatic correlation between the various events.Prelude is commited to providing an Hybrid IDS that offers the ability to unify currently available tools into one, powerful, and distributed application.

The sysstat package contains the sar, sadf, iostat and mpstat, commands for Linux. The sar command collects and reports system activity information. The sadf command may be used to display data collected by sar in various formats (XML, database-friendly, etc.). The iostat command reports CPU statistics and I/O statistics for tty devices and disks. The mpstat command reports global and per-processor statistics. The information collected by sar can be saved in a file in a binary format for future inspection. The statistics reported by sar concern I/O transfer rates, paging activity, process-related activites, interrupts, network activity, memory and swap space utilization, CPU utilization, kernel activities, and TTY statistics, among others. Both UP and SMP machines are fully supported.

Tenshi is a log monitoring program, designed to watch one or more log files for lines matching user defined regular expressions and report on the matches. The regular expressions are assigned to queues which have an alert interval and a list of mail recipients. Queues can be set to send a notification as soon as there is a log line assigned to it, or to send periodic reports.

TestDisk is a tool to check and undelete partitions. It works with the following partitions: FAT12, FAT16, FAT32, Linux, Linux swap (version 1 and 2), NTFS (Windows NT/W2K/2003), BeFS (BeOS), UFS (BSD), JFS, XFS, and Netware.

Webmin is a web-based interface for system administration for Unix. Using any browser that supports tables and forms (and Java for the File Manager module), you can setup user accounts, Apache, DNS, file sharing and so on. Webmin consists of a simple web server, and a number of CGI programs which directly update system files like /etc/inetd.conf and /etc/passwd. The web server and all CGI programs are written in Perl version 5, and use no non-standard Perl modules.