HIDS & backup [Was: Re: Server Support]

[Filippo Spike Morelli]

On Thursday 09 February 2006 10:54, Ivan Krstic wrote:
Hi
> Alessio Igor Bogani wrote:
> > Ok my question is: what is exactly supported for 5 years?
>
> http://people.ubuntu.com/~cjwatson/seeds/ubuntu-server-dapper/

by reading the above link I found out that aide is gonna be included as 
supported package. Imho as FAM/HIDS it would be much better to support 
samhain [1]. There isnt even real comparison between the two: aide can barely 
do file alteration monitoring, while samhain is a proper HIDS and among its 
features lists *very* important things like:
- daemon stealth mode, allowing the samhain process to hide from attackers
- client server architecture
- centralized events database backend

Also, backuppc appears to be the solution that will be supported. Why has it 
been chosen over Bacula[2]? Because of licence issues? I wont descend into a 
comparison now because the licence could be a problem making any other 
discussion poinless.


[1] http://samhain.sourceforge.net/
[2] http://bacula.org

-- 
"And then the lord said to John: "Come forth and gain eternal life."
But John came fifth and won a toaster."
					
						some guy on irc