security/samhain 4.4.3_1

Samhain Intrusion Detection System

Repository: FreeBSD ports
Maintainer: [email protected]
Last update: 2026-07-15
Commit: 0ba9c45575
License: GPLv2
Categories: security
Package size: 619.0 KiB, 1159.9 KiB installed

Description

Samhain is an open source file integrity and host-based intrusion detection system for Linux and Unix. It can run as a daemon process, and thus can remember file changes - contrary to a tool that runs from cron, if a file is modified you will get only one report, while subsequent checks of that file will ignore the modification as it is already reported (unless the file is modified again).

Samhain can optionally be used as client/server system to provide centralized monitoring for multiple host. Logging to a (MySQL or PostgreSQL) database is supported.

Install

As a binary package — by origin, or by package name:

pkg install security/samhain
pkg install samhain

From the ports tree:

cd /usr/ports/security/samhain/ && make install clean

To depend on this port in another port's Makefile:

RUN_DEPENDS=	samhain>0:security/samhain

Packages

The version each package repository carries. “-” means the repository builds no package of it, “n/a” that there is no such repository.

Repository	aarch64	amd64	armv6	armv7	i386
FreeBSD:14:latest	4.4.3_1	4.4.3_1	4.4.3	4.4.3_1	4.4.3_1
FreeBSD:14:quarterly	4.4.3_1	4.4.3_1	n/a	4.4.3_1	4.4.3_1
FreeBSD:15:latest	4.4.3_1	4.4.3_1	n/a	4.4.3_1	4.4.3_1
FreeBSD:15:quarterly	4.4.3_1	4.4.3_1	n/a	n/a	n/a
FreeBSD:16:latest	4.4.3_1	4.4.3_1	n/a	n/a	n/a
FreeBSD:16:quarterly	n/a	n/a	n/a	n/a	n/a

Repository

aarch64

amd64

armv6

armv7

i386

FreeBSD:14:latest

4.4.3_1

4.4.3

4.4.3_1

FreeBSD:14:quarterly

4.4.3_1

n/a

4.4.3_1

FreeBSD:15:latest

4.4.3_1

n/a

4.4.3_1

FreeBSD:15:quarterly

4.4.3_1

n/a

FreeBSD:16:latest

4.4.3_1

n/a

FreeBSD:16:quarterly

n/a

Dependencies

The Makefile names none itself; they come from USES and USE_*.

The full lists below include those, and their dependencies in turn.

No port depends on this one.

Configuration

Options name: security_samhain

Option	Default	Description
ASM	on	Use optimized assembly code
DB_RELOAD	off	Enable database reload on SIGHUP
DEBUG	off	Build with debugging support
DNMALLOC	on	Enable dnmalloc
DOCS	off	Build and/or install documentation
ENCRYPT	on	Enable client/server encryption
GNUPG	off	GNU Privacy Guard support
IPV6	off	IPv6 protocol support
LIBWRAP	on	TCP wrapper support
LOGFILE_MONITOR	off	Enable monitor logfiles
LOGIN_WATCH	off	Enable watch for login/logout
MAIL	on	Enable internal SMTP mailer
MOUNTS_CHECK	off	Enable check mount options on filesystems
MYSQL	off	MySQL database support
ODBC	off	ODBC database backend
PGSQL	off	PostgreSQL database support
PORT_CHECK	off	Enable check ports
POSIX_ACL	off	Enable check posix acls
PROCESS_CHECK	off	Enable check processes
PTRACE	off	Enable use anti-debugger options
SRP	on	Enable SRP for authentication
STATIC	off	Build static executables and/or libraries
SUIDCHECK	off	Enable check for suid/sgid files
UDP	off	Enable UDP server
USERFILES	off	Enable check for users config files
XML_LOGS	off	Enable XML-formatted logs

Option

Default

Description

ASM

Use optimized assembly code

DB_RELOAD

off

Enable database reload on SIGHUP

DEBUG

off

Build with debugging support

DNMALLOC

Enable dnmalloc

DOCS

off

Build and/or install documentation

ENCRYPT

Enable client/server encryption

GNUPG

off

GNU Privacy Guard support

IPV6

off

IPv6 protocol support

LIBWRAP

TCP wrapper support

LOGFILE_MONITOR

off

Enable monitor logfiles

LOGIN_WATCH

off

Enable watch for login/logout

MAIL

Enable internal SMTP mailer

MOUNTS_CHECK

off

Enable check mount options on filesystems

MYSQL

off

MySQL database support

ODBC

off

ODBC database backend

PGSQL

off

PostgreSQL database support

PORT_CHECK

off

Enable check ports

POSIX_ACL

off

Enable check posix acls

PROCESS_CHECK

off

Enable check processes

PTRACE

off

Enable use anti-debugger options

SRP

Enable SRP for authentication

STATIC

off

Build static executables and/or libraries

SUIDCHECK

off

Enable check for suid/sgid files

UDP

off

Enable UDP server

USERFILES

off

Enable check for users config files

XML_LOGS

off

Enable XML-formatted logs

USES: shebangfix
Service scripts: none

Message after installing

To start the samhain daemon at system boot, add:

samhain_enable="YES"

and/or

yule_enable="YES"

to /etc/rc.conf.

Files

Manual pages 4

samhain(8)
samhainrc(5)
yule(8)
yulerc(5)

pkg-plist 32

@dir /var/lib
share/doc/samhain/BUGS
share/doc/samhain/FAQ.html
share/doc/samhain/HOWTO-client+server-troubleshooting.html
share/doc/samhain/HOWTO-client+server.html
share/doc/samhain/HOWTO-samhain+GnuPG.html
share/doc/samhain/HOWTO-write-modules.html
share/doc/samhain/MANUAL-2_4.pdf
share/doc/samhain/README
share/doc/samhain/README.UPGRADE
share/doc/samhain/sh_mounts.txt
share/doc/samhain/sh_userfiles.txt
@dir share/doc/samhain
@dir /var/lib/samhain
@sample etc/samhainrc.sample
etc/rc.d/samhain
share/man/man5/samhainrc.5.gz
share/man/man8/samhain.8.gz
sbin/samhain
sbin/samhain_setpwd
@dir /var/lib/yule
@dir /var/log/yule
@sample etc/yulerc.sample
@postunexec echo "To delete the yule user permanently, use 'pw userdel yule'"
etc/rc.d/yule
share/man/man5/yulerc.5.gz
share/man/man8/yule.8.gz
sbin/yule
sbin/yule_setpwd
sbin/yuleadmin-gpg.pl
sbin/yuleadmin-sig.pl
sbin/yulectl

distinfo 1

File	Size	SHA256
samhain_signed-4.4.3.tar.gz	2.160977e+06	3e57574036d5055e9557ec5095818b419ea6c4365370fc2ccce1e9f87f9fad08

File

Size

SHA256

samhain_signed-4.4.3.tar.gz

2.160977e+06

3e57574036d5055e9557ec5095818b419ea6c4365370fc2ccce1e9f87f9fad08

Master sites 1

http://la-samhna.de/archive/

Commit history 1

Date Commit Credits Log message

Date	Commit	Credits	Log message
2026-07-15	`0ba9c45575`	Muhammad Moinur Rahman	security/samhain: Remove non-default option PRELUDE prelude has been defunct for some times and have been marked deprecated. This removes the non-default OPTION PRELUDE. PR: 296317 Approved by: [email protected] (maintainer-timeout)

2026-07-15

0ba9c45575

Muhammad Moinur Rahman

security/samhain: Remove non-default option PRELUDE

prelude has been defunct for some times and have been marked deprecated. This removes the non-default OPTION PRELUDE. PR: 296317 Approved by: [email protected] (maintainer-timeout)