SID is a Shell Intrusion Detection system. The kernel part plugs into a terminal-processing subsystem and logs hashed terminal lines. The user part reads log entries (hashes), consults a list of allowed entries, and takes appropriate action upon unexpected log entries. Currently supported are Solaris and Linux.
c01d1b8d56664efff0d94f0b02db8ab3f2c6986ec87d293a0fe7109663e1a8d4