CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

security/samhain 4.4.3_1

Samhain Intrusion Detection System

Port info

Maintainer
freebsd@gregv.net
Packages
latest: 4.4.3_1
Upstream
Higher version available: 4.5.3
Last update
to 4.4.3_1 · 0ba9c45575
Quarterly
2026Q4: 4.4.3_1
WWW
https://la-samhna.de/samhain/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install samhain
installs 4.4.3_1 from latest; from quarterly (2026Q4) 4.4.3_1
Port
# cd /usr/ports/security/samhain && make install clean
# make -C /usr/ports/security/samhain config  # change options first
Size
638 KiB download · 1.2 MiB installed
Depends on
nothing
License
GPLv2
Options
8 of 26 on in the package: ASM DNMALLOC DOCS ENCRYPT IPV6 LIBWRAP MAIL SRP
Show the 18 options that are off
DB_RELOAD DEBUG GNUPG LOGFILE_MONITOR LOGIN_WATCH MOUNTS_CHECK MYSQL ODBC PGSQL PORT_CHECK POSIX_ACL PROCESS_CHECK PTRACE STATIC SUIDCHECK UDP USERFILES XML_LOGS
pkg-message
Shown after installing
To start the samhain daemon at system boot, add:

samhain_enable="YES"

and/or

yule_enable="YES"

to /etc/rc.conf.

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 164.4.3_14.4.3_1–
FreeBSD 154.4.3_14.4.3_1–
FreeBSD 144.4.3_14.4.3_14.4.3_1

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 154.4.3_14.4.3_1–
FreeBSD 144.4.3_14.4.3_14.4.3_1

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 4.4.3_1.

Fixed (0)

No VuXML entries for this package.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (138)

Renato Botelho (garga) · 2.2.0_1
Fix build on 4.x

Reported by:	krismail
e7941206aa
Renato Botelho (garga) · 2.2.0_1
- Chase libprelude version - Bump PORTREVISION

PR:		ports/96758, ports/96759, ports/96760
Submitted by:	maintainer
ef92eb19dd
Cheng-Lung Sung (clsung) · 2.2.0
Updating the Samhain HIDS to 2.2.0. Changes since last version: -  For files under the 'GrowingLogfiles' policy, the checksum is now    verified up to the previous size. -  Server-to-server relay is possible. -  More user policies are available now.

PR:		ports/96643
Submitted by:	maintainer (David Thiel)
8b0e2e7564
Sam Lawrance (lawrance) · 2.1.2_1
When yule is installed, add the yule user and group as well.  This is especially useful for package users since they couldn't run the install-user target.

PR:		ports/90305 (based on)
Submitted by:	David Thiel <lx@redundancy.redundancy.org> (maintainer)
Approved by:	maintainer timeout on feedback (3 months)
Committed from:	Sydney Linux User Group codefest at UTS
f53abc50e8
Marcus Alves Grando (mnag) · 2.1.2
- Update to 2.1.2 - Add PRELUDE option

PR:		94406
Submitted by:	Robin Gruyters <r.gruyters@yirdis.nl>
Approved by:	maintainer
f071d47d55
Edwin Groothuis (edwin) · 2.1.0
SHA256ify

Approved by: krion@
32487a10ad
Edwin Groothuis (edwin) · 2.1.0
Update: security/samhain 2.0.10 -> 2.1.0

Updating the Samhain integrity checking system to 2.1.0, a
	bugfix release.

	It's been requested by several people to break Samhain out
	into separate client and server ports. This PR does that,
	with a samhain-client and samhain-server port, as slave
	ports off of samhain. I'm not sure the best way to submit
	a PR to do this kind of action, but here is a shar of all
	three ports. If another format is desired, please let me
	know.  I'm also interested in feedback on the approach used
	for splitting these out.

PR:		ports/90305
Submitted by:	David Thiel <lx@redundancy.redundancy.org>
881216b3bd
Vsevolod Stakhov (vsevolod) · 2.0.10
Fix DISTNAME variable.

Reported by:	Jin-Shan Tseng <tjs@cdpa.nsysu.edu.tw>
Pointy hat to:	vsevolod
fa8ed25c45
Vsevolod Stakhov (vsevolod) · 2.0.10
Update to 2.0.10 [1] Feed portlint

PR:		86426 [1]
Submitted by:	David Thiel (maintainer) [1]
f22ba4665b
Pav Lucistnik (pav) · 2.0.9
- Replace .error with IGNORE to prevent INDEX build failures
944cbf4d77
Pav Lucistnik (pav) · 2.0.9
- Update to 2.0.9 - samhainrc.sample file is chgrp'd to wheel - RUNAS_USER now defaults to "yule" properly - XML logging is now on by default and tunable

PR:		ports/85448
Submitted by:	David Thiel <lx@redundancy.redundancy.org> (maintainer)
54b77a9bfb
Thierry Thomas (thierry) · 2.0.8
Update to 2.0.8.

PR:		83960
Submitted by:	Babak Farrokhi <babak (at) farrokhi.net>
Approved by:	maintainer
e6b6ab8c0c
Pav Lucistnik (pav) · 2.0.6
- Update to 2.0.6

PR:		ports/80622
Submitted by:	David Thiel <lx@redundancy.redundancy.org> (maintainer)
e445ef13a9
Pav Lucistnik (pav) · 2.0.2
- Update to 2.0.2

PR:		ports/73699
Submitted by:	David Thiel <lx@redundancy.redundancy.org> (maintainer)
b000f92b14
Pav Lucistnik (pav) · 2.0.1
- Update to 2.0.1

PR:		ports/73501
Submitted by:	David Thiel <lx@redundancy.redundancy.org> (maintainer)
a4e985ac52
Pav Lucistnik (pav) · 2.0.0
- Update to 2.0.0

PR:		ports/73393
Submitted by:	David Thiel <lx@redundancy.redundancy.org> (maintainer)
e1149e6424
Pav Lucistnik (pav) · 1.8.12
- Fix OPTIONS handling
4362f450bd
Pav Lucistnik (pav) · 1.8.12
- Update to 1.8.12 and unbreak on 5.x

PR:		ports/72750
Submitted by:	David Thiel <lx@redundancy.redundancy.org> (maintainer)
45636cdeb0
Edwin Groothuis (edwin) · 1.8.11
Update: security/samhain 1.8.10b -> 1.8.11

Updating the Samhain integrity checking system from 1.8.10b to 1.8.11.

	Code changes include:

	o for files in the IgnoreAll policy, there are no warnings
	  (anymore) about 'no such user/group' and/or non-printable filenames
	o there is a new option HardlinkOffset=... to specify an
	  offset from the canonical hardlink count for a directory
	o ... and a new option AddOKChars=... to modify the set of
	  characters in a filename for which a warning (about
	  obscure/non-printable) filename is issued.

	Port changes:

	Turn off kernel integrity checking by default - building
	this into packages wouldn't work anyhow, since it would
	only work with an identical kernel as on the build cluster.

PR:		ports/71169
Submitted by:	David Thiel <lx@redundancy.redundancy.org>
49a52357b8
Kris Kennaway (kris) · 1.8.10b
BROKEN on 5.x: Does not compile

Approved by:    portmgr (self)
82f9e5ad55
Pav Lucistnik (pav) · 1.8.10b
- Update to 1.8.10b

PR:		ports/69387
Submitted by:	David Thiel <lx@redundancy.redundancy.org> (maintainer)
7dcf14e7f0
Pav Lucistnik (pav) · 1.8.9
- Update to 1.8.9

PR:		ports/68173
Submitted by:	David Thiel <lx@redundancy.redundancy.org> (maintainer)
00f5bfe7b2
Pav Lucistnik (pav) · 1.8.7
- Update to 1.8.7 - Fix WITH_LOGSERVER knob

PR:		ports/66578
Submitted by:	David Thiel <lx@redundancy.redundancy.org> (maintainer)
879629d714
Kirill Ponomarev (krion) · 1.8.6
- Update to version 1.8.6

PR:		ports/65778
Submitted by:	maintainer
280ba38d36
Kirill Ponomarev (krion) · 1.8.5
- Update to version 1.8.5

PR:		ports/65226
Submitted by:	maintainer
bfbada120a
Kirill Ponomarev (krion) · 1.8.4
- Update to version 1.8.4

PR:		ports/64480
Submitted by:	maintainer
d903799309
Trevor Johnson (trevor) · 1.8.3
Add size data, approved by maintainers.
3bca696b10
Mark Linimon (linimon) · 1.8.3
Update to 1.8.3.  See docs/Changelog for full details.  Notable:

new option SetBindAddress (--bind-address=...) to force
   interface for outgoing connections on multi-interface box
 use persistent connection to database by default

PR:		ports/62290
Submitted by:	David Thiel <lx@redundancy.redundancy.org>
228b8c4ea4
Pav Lucistnik (pav) · 1.8.2
- Update to 1.8.2

PR:		ports/61588
Submitted by:	David Thiel <lx@redundancy.redundancy.org> (maintainer)
b453555a02
Mark Linimon (linimon) · 1.8.1
Update to 1.8.1, mostly minor bugfixes.  See docs/Changelog for details.

PR:		ports/59935
Submitted by:	David Thiel <lx@redundancy.redundancy.org> (maintainer)
d97fe6f483
Kirill Ponomarev (krion) · 1.8.0
- Update to version 1.8.0

PR:		58790
Submitted by:	maintainer
f864a51ed0
Daichi GOTO (daichi) · 1.7.12
update security/samhain: 1.7.11 -> 1.7.12   - Updating Samhain to 1.7.12, which contains fixes for a heap overflow     in e-mail parsing.

PR:		57965
Submitted by:	David Thiel <lx@redundancy.redundancy.org> (maintainer)
f62aaf4782
Edwin Groothuis (edwin) · 1.7.11
Update port: security/samhain

Update to 1.7.11.

PR:		ports/56754
Submitted by:	David Thiel <lx@redundancy.redundancy.org>
1aa6b2c7fa
Daichi GOTO (daichi) · 1.7.10
update security/samhain: 1.7.9 -> 1.7.10

PR:		54997
Submitted by:	David Thiel <lx@redundancy.redundancy.org> (maintainer)
d3094051ee
Daichi GOTO (daichi) · 1.7.9
update security/samhain: 1.7.8 -> 1.7.9

PR:		54481
Submitted by:	David Thiel <lx@redundancy.redundancy.org> (maintainer)
a4946c669f
Edwin Groothuis (edwin) · 1.7.8
iUpdate of Samhain to 1.7.8

Update to version 1.7.8
	Fix build when MySQL logging is enabled
	Add LOG_SERVER and ALT_LOG_SERVER tunables
	Require LOG_SERVER be defined for clients
	Have clients request config and signatures from server by default
	Change TRUSTED_USER to a more accurate name (RUNAS_USER)
	Fix sample config file install/deinstall
	Add documentation on tunables

PR:		ports/52912
Submitted by:	David Thiel <lx@redundancy.redundancy.org>
5cf3ad9d98
Christian Weisgerber (naddy) · 1.7.5
Update to 1.7.5, fix packing list bugs, and add a more reliable MASTER_SITE.

PR:		51044
Submitted by:	David Thiel <lx@redundancy.redundancy.org>
d90aca28ba
Edwin Groothuis (edwin) · 1.7.4
The Samhain Intrusion Detection System

Samhain is a host-based Intrusion Detection System and
	integrity checker with advanced features such as centralized
	logging, MySQL/PostgreSQL support, and rootkit detection.

PR:		ports/46982
Submitted by:	David Thiel <lx@redundancy.redundancy.org>
5db5ae58ad