arno-iptables-firewall and checksecurity. The second of these two once installed alerted me to an attack on all of my system's grep binaries. I forced a delete of binaries and purged them from the system's archive then downloaded and installed them from the debian web site. I'm sure that's not the only problem happening here, but when this system gets reinstalled the passwords are going to be better and those are the first two packages that get downloaded and installed once installation finishes. The checksecurity package doesn't need or use X to run and it was something I found while looking for something else.
