sf-secure-system extension provides tools like debsums or rkhunter, with secure, strict configuration.