Is there any Linux firewall like ZoneAlarm, Keiro or Comodo in Windows environment?
I like to to able to monitor and block any Linux program from making in/out TCP/UDP connections on per application base.
netfilter, ipfilter can only handle it on system level.
More details on my ideal "Big Brother" Security Monitor.
I like to setup the following security policy: Only Apache is allowed to accept connections from everything. MySQL can accept connections from only a select few IPs. If any other application tries to accept / make any connections, log it and flags it for analysis. Log the time, app name, user, to where, amount of traffic xfer, trigger script to do stack dump, strace on the pid, etc). X GUI config is nice, but I am not a GUI person. Prefer web or XML base configuration and logging for ease of analysis. Should be able to track app even if the user is root. Track app base on name/path Validate the app's size, date, first and last 32 bytes value (Optionally, md5/shar sig of the whole app.)