Freedom251 › File Integrity Monitoring Software

Samhain

Free plan LinuxMacSelf-hostedWindows

What Samhain is

Samhain is a free file-integrity and host-based intrusion detection system for monitoring files, logs, and host activity. It checks checksums and attributes including permissions, ownership, timestamps, inode, and symbolic-link targets, and can detect rootkits, rogue SUID executables, open ports, and hidden processes. It can operate on one host or monitor multiple systems through a client/server setup. In that setup, Yule collects client reports, distributes baseline databases and configuration files, and tracks client status. Optional checks cover log formats such as UNIX syslog and Apache logs, as well as Windows registry keys under Cygwin, SUID/SGID files, mounted filesystems, and login events. Security measures include signed configuration and database files, signed reports, authenticated client connections, encrypted central logging, and stealth options. Beltane is a separate web console for reports and baseline updates; it requires a client/server installation and SQL logging. Samhain is distributed under the GNU General Public Licence and runs on Linux, macOS, Windows via Cygwin, and other POSIX systems. The listed Windows/Cygwin testing applies to the monitoring agent, not the server.

Who it suits

Samhain suits administrators who need file-integrity and host monitoring on individual machines or across multiple hosts. Its central console and reporting features require a client/server setup, and Beltane also requires SQL logging.

What it does well

Free and distributed under the GNU General Public Licence
Checks file checksums and metadata
Client/server setup centralizes reports and baselines
Optional log and host-activity monitoring
Signed reports and encrypted central logging

What to know first

Windows/Cygwin testing covers the agent, not the server
Beltane requires client/server installation and SQL logging
Agentless monitoring is not supported

Getting started

Visit https://la-samhna.de/samhain/.
Choose the package for Linux, macOS, Windows via Cygwin, or a supported POSIX system.
Install Samhain on a single host or configure a client/server deployment with Yule for multiple hosts.
Use the manual, FAQ, or HOWTOs for guidance.
For the Beltane web console, set up a Samhain client/server installation and SQL logging.

Verdict

Samhain offers host monitoring with both standalone and centralized deployment options. Readers using Windows should note that the listed testing applies to the monitoring agent rather than the server.

Questions

Is Samhain free?

Yes. Samhain is free and distributed under the GNU General Public Licence.

Which platforms does Samhain support?

It supports POSIX systems including Linux, *BSD, Solaris, AIX, HP-UX, and Mac OS X, plus Windows via Cygwin. Windows/Cygwin testing is for the monitoring agent, not the server.

Can Samhain monitor multiple hosts?

Yes. Its client/server setup uses Yule to collect reports, distribute baselines and configuration, and track client status.

Is Beltane included as the Samhain management console?

Beltane is a separate web-based console for reports and centrally stored baselines. It requires a Samhain client/server installation and SQL logging.

What integrations does Samhain support?

It can function as a Prelude sensor, includes a Nagios plugin, and can send messages to named pipes, System V message queues, and external programs.

Who publishes Samhain?

The legal notice names WEP e.V., Samhain Labs department, as the editorial responsibility and lists Dr. Rainer Wichmann in Lüneburg, Germany.

Facts from Samhain's own pages

Central management: The client/server system uses Yule to collect client reports, distribute baseline databases and configuration files, and track client status. · la-samhna.de, 4 Oct 2026
Database support: The fact sheet lists Oracle, MySQL, and PostgreSQL for storing client reports; it says a database is needed for the Beltane console. · la-samhna.de, 4 Oct 2026
Deployment: It can run standalone on one host or monitor multiple hosts through a client/server setup with centralized logging and maintenance. · la-samhna.de, 4 Oct 2026
Documentation and support: The project provides a user manual, FAQ, HOWTOs, user forum, and a support contact address. · la-samhna.de, 4 Oct 2026
File checks: It can check file checksums and metadata including permissions, ownership, timestamps, inode, and symbolic link targets. · la-samhna.de, 4 Oct 2026
File integrity: It can check file checksums and attributes including size, permissions, ownership, timestamps, inode, and symbolic link targets. · la-samhna.de, 4 Oct 2026
Integrations: Samhain can function as a Prelude sensor, includes a Nagios plugin, and can send messages to named pipes, System V message queues, and external programs. · la-samhna.de, 4 Oct 2026
Latest listed release: The download page lists version 4.5.3, released October 31, 2025, and provides a SHA-256 checksum and PGP signature verification instructions. · la-samhna.de, 4 Oct 2026
License: Samhain is distributed under the GNU General Public Licence. · la-samhna.de, 4 Oct 2026
License and release: Samhain is distributed under the GNU General Public Licence; the download page lists version 4.5.3, released October 31, 2025. · la-samhna.de, 4 Oct 2026
Linux monitoring: On Linux, inotify can provide immediate file change notifications, and the kernel audit system can identify the login user who changed a file. · la-samhna.de, 4 Oct 2026
Log monitoring: Optional log analysis supports UNIX syslog, Apache access and error logs, Samba logs, and BSD style process accounting logs. · la-samhna.de, 4 Oct 2026
Management console: Beltane is a separate web based PHP console for viewing client reports and updating baseline databases; it requires a Samhain client/server installation and SQL logging. · la-samhna.de, 4 Oct 2026
Monitoring: Optional checks cover log formats including UNIX syslog and Apache logs, Windows registry keys under Cygwin, SUID/SGID files, open ports, hidden or fake processes, mounted filesystems, and login events. · la-samhna.de, 4 Oct 2026
Notable limit: The fact sheet says Windows/Cygwin support is tested for the Samhain monitoring agent only, not the server. · la-samhna.de, 4 Oct 2026
PCI DSS: The fact sheet describes incremental checks on growing log files as supporting the PCI DSS requirement to detect changes to existing log data. · la-samhna.de, 4 Oct 2026
Platforms: The fact sheet lists POSIX systems including Linux, BSD, Solaris, AIX, HP-UX, and Mac OS X, plus Windows 2000/XP with POSIX emulation; Windows support is tested for the agent only, not the server. · la-samhna.de, 4 Oct 2026
Project publisher: The legal notice names WEP e.V., Samhain Labs department, as the editorial responsibility and lists Dr. Rainer Wichmann in Lüneburg, Germany. · la-samhna.de, 4 Oct 2026
Purpose: Samhain is a file integrity and host based intrusion detection system that monitors files and logs, and detects rootkits, rogue SUID executables, open ports, and hidden processes. · la-samhna.de, 4 Oct 2026
Security: Samhain supports signed database and configuration files, signed reports, authenticated client connections, encrypted central logging, and stealth options. · la-samhna.de, 4 Oct 2026
Support: Support options include documentation, a user forum and mailing list, bug reports by contact form or email, and an inquiry option for commercial installation or maintenance support. · la-samhna.de, 4 Oct 2026
Tamper resistance: The project describes signed configuration and database files, signed reports, encrypted messages to the central log server, and stealth options. · la-samhna.de, 4 Oct 2026
Web console: Beltane is a separate web-based console that presents client reports and supports updating centrally stored baseline databases. · la-samhna.de, 4 Oct 2026

Where Samhain stands on Freedom251

File Integrity Monitoring Software#10 of 34