I am looking for an reasonably easy to configure, Open Source, Host Intrusion Detection System that I can run on my server. Does anybody have any recommendations, links or information about these?

Thanks in advance

1. samhain ( http://la-samhna.de/samhain/ )

2. Osiris ( http://osiris.shmoo.com/ )

Intresting thread.

Tripwire is a IDS isn't?

no. it is not. tripwire is not an IDS. it acts like aide, another open source file intregrity checker. it checks for changes in files/binaries/etc. tripwire is older than aide. aide is the improvement/replacement for tripwire.

any reference for the aide?

I can see very slow improvements

aide - 0.10 - November 27, 2003

Thanks for your replies.
Samhain looks like the best bet for me at the moment. I like the security that is inbuilt into its logs and processes.

I am also looking for a system that can temporarily block IP's that are misbehaving, such as the SSH username attack that I am getting everyday and have quite a large list of IP's that are being now being blocked by the servers firewall (iptables/ipchains).

This list grows by the day and I was wondering if there is anything that I can implement to automatically detect these attacks and port scans on a host and then block the IP for a set time or something?

Thanks again