2. Requirements

POSIX environment

Samhain will only compile and run in a POSIX operating system, or an emulation thereof (e.g. the free Cygwin POSIX emulation for Windows XP/2000).

ANSI C compiler and build system

You need an ANSI C compiler to compile samhain. The GNU C compiler (GCC) from the Free Software Foundation (FSF) is fine. If your vendor's compiler is ANSI compliant, you should give it a try, since it might produce faster code. Also you will need to have standard tools like make in your PATH (the make tool is part of the POSIX standard).


If you want to use signed configuration and database files (this is an optional feature), GnuPG (gpg) must be installed.

[OPTIONAL] libacl/libattr

Samhain can check and verify POSIX ACLs (access control lists, on operating systems supporting them) and SELinux attributes (Linux). This feature is only compiled in if the required libraries and header files are present (e.g. on Linux the libacl/libattr development packages; in Debian these are named libacl1-dev, libattr1-dev).


Samhain can store the content of files in the baseline database (for files smaller than 9200 bytes after zlib compression). This feature is only available if the zlib library and header files are present (e.g. on Linux the libz development package; in Debian this is named zlib1g-dev).


Samhain can monitor logfiles of other applications, e.g. Syslog, Apache (or other webservers with similar log formats), Samba, or pacct (BSD-style process accounting). This extension requires the PCRE (Perl Compatible Regular Expressions) library, e.g. on linux the libpcre package (and for compiling, also the libpcre development package). In Debian, this would be libpcre3 and libpcre3-dev.