sktrap (script kiddies trap) is a tiny intrusion detection system. Installed on the monitor server, it runs tests via ssh on its clients. Cracks very visible (files,open ports). Built in reply to and very succesful in finding real-world break-ins.
KISS is a kernel-side host-oriented security tool, which may bring you file integrity checking, file and process hiding and actions handling on special internal events (using a tiny scripting language).