Linux Intrusion Detection System
The Linux Intrusion Detection System (LIDS) is a kernel patch and admin tools which enhances the kernel's security by implementing Mandatory Access Control (MAC). When it is in effect, chosen file access, all system network administration operations, any capability use, raw device, memory, and I/O access can be made impossible even for root. You can define which programs can access specific files. It uses and extends the system capabilities bounding set to control the whole system and adds some network and filesystem security features to the kernel to enhance the security. You can finely tune the security protections online, hide sensitive processes, receive security alerts through the network, and more. LIDS currently support Linux kernel 2.6, 2.4. LIDS is released under GPL.
Awards
- Top 75 security tools in 2003, http://www.insecure.org/tools.html
- Top 50 Security tools in 2000, http://www.insecure.org/tools2000.html
- Best of Linux for October 9, 2000, http://Linux.DaveCentral.com