This is a rewrite of my previous post as it was not entirely clear what I was trying to achieve. Hopefully this will make more sense :)
In a nutshell what I am looking for is alternative methods to detect if my system is compromised beyond using tools such as tripwire/OSSEC/samhain/rkhunter and just general file integrity checking and log monitoring. I am deliberately trying not to be too specific with my question as I am after ideas in general so I can implement them on my own machine. This will probably be but not limited to a script that is ran at set intervals (cronjob) and notifies the administrator if something has changed and prompt an administrator to investigate further via (syslog/email?). Note I am not necessarily after the code itself just a high level overview of what it does. Feel free to be as verbose as you like.
It may help if I list a few things which I currently do to give you a general idea of the ideas I am after.
1) Generate an md5sum of the output of my running iptables and compare it to a known good hash. If this changes it is safe to assume that someone has added/removed an iptables entry.
2) I have certain mount points which are read only (/usr, /boot etc) because they should not change very often. If a partition changes from read only to writable I want to be notified.
3) Monitor the output of netstat for listening services only. Perform a file comparison (diff) against a file containing known good values. If something has been added its possible someone has added a new service to the system. Possible backdoor?
Note the above will generate false positives if I am doing system maintenance. However if these change when I am not I would consider them suspicious and investigate further. Note these are just examples and do have flaws like everything but the more hurdles you have the chances of someone tripping up are increased.
Thanks in advance.