Defensive Linux Security Tools

Firewalls

• iptables
• firewalld
• ufw
• Guarddog
• Vuurmuur
• Gufw
• Shorewall

Security Audit

• OpenSCAP
• OpenVAS
• Nmap
• Nikto
• Lynis
• SpiderFoot

Rootkit / Malware Detection

• Wazuh
• chkrootkit
• rkhunter
• Tiger
• Linux Malware Detect (LMD)

Access Control

• SELinux
• AppArmor
• Smack
• Grsecurity
• Yama

Sandboxing

• Bubblewrap
• Firejail
• Flatpak
• Snap
• Chroot Jail

IDS / IPS

• Snort
• Suricata
• Zeek
• OSSEC
• AIDE
• Security Onion
• OSSIM
• CrowdSec

File Integrity Monitoring

• Tripwire
• auditd
• Samhain
• OSSEC
• Wazuh
• Osquery
• Atomic OSSEC

Antivirus

• CrowdStrike
• ClamAV
• Rspamd

Log Monitoring

• Logwatch
• ELK Stack
• Graylog
• Sagan
• Fluentd
• OpenObserve
• Dynatrace

Disk / Filesystem Encryption

• dm-crypt
• fscrypt
• EncFS
• VeraCrypt
• gocryptfs
• eCryptfs
• SecureFS

Secure Shell Protection

• SSHGuard
• DenyHosts
• Knockd
• Fail2ban

Password Security

• John the Ripper
• Hashcat
• KeePassXC
• pwgen
• GoPass

VPN

• strongSwan
• OpenVPN
• WireGuard
• LibreSwan
• SoftEther VPN

Patch Management

• Spacewalk
• Katello
• Red Hat Satellite
• Landscape
• NinjaOne

WAFs

• ModSecurity
• NAXSI
• BunkerWeb
• Coraza
• Open AppSec

Container Security

• Docker Bench
• Calico
• Clair
• gVisor
• Grafeas
• Falco
• Dagda
• Cilium
• Dockle