Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking for options to be compliant with PCI-DSS section 11.5 for some servers I manage at the datacenter. There are several servers (less than 20) and they are mostly CentOS5, but there are some RHEL4 and Solaris9 Sparc. I believe Tripwire, Inc. is the leader in this area, but I am looking for additional options, both commercial and FOSS. Please include your experience reasons for using the software you recommend.

share|improve this question

closed as off-topic by Magellan, TheCleaner, Falcon Momot, mdpc, MadHatter Sep 5 '13 at 8:49

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Magellan, TheCleaner, Falcon Momot, mdpc, MadHatter
If this question can be reworded to fit the rules in the help center, please edit the question.

4 Answers 4

up vote 2 down vote accepted

You can take a look at Samhain for an Open Source solution.

When I used it in my last job, it was only a file integrity checking solution, but it seems it has since evolved in a more complete solution...

share|improve this answer
    
Any comments on using it? Easy to use? Difficult to install? etc. –  dialt0ne Oct 8 '09 at 21:55

As a commercial option (i.e. typically better supported and easier to use, but obviously more expensive :), I'd suggest Verisys, a commercial file integrity monitoring system.

My main reason for suggesting it is that it's a lot cheaper than Tripwire. It doesn't provide all the 'change management' kind of features that Tripwire does, but not everyone needs that. Verisys is a lot easier to use too.

share|improve this answer

OSSEC will also do integrity monitoring and is dead simple to use. It integrates very well with SIEMs such as Prelude if you are using that. Has a web interface available that will make checking the integrity information really easy.

share|improve this answer

Additional options:

http://www.la-samhna.de/library/scanners.html

Make your own educated choice. Depending on the number of hosts you have, having a centralized reporting server or mechanism is going to be important. Take that into consideration.

share|improve this answer

protected by sysadmin1138 Dec 3 '12 at 12:51

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.