RKHunter : Detect Rootkit
2016/01/17 |
Install RKHunter which is the Rootkit Detection tool.
|
|
[1] | Install RKHunter. |
root@dlp:~# apt-get -y install rkhunter
|
[2] | Configure and Use RKHunter. For regular checking, checking script is installed under cron.daily directory and it is executed everyday by Cron. |
root@dlp:~#
vi /etc/default/rkhunter # line 9: daily run CRON_DAILY_RUN=" true "
# line 13: weekly DB update CRON_DB_UPDATE=" true "
# line 17: send report for updating DB DB_UPDATE_EMAIL=" true "
# update database root@dlp:~# rkhunter --update
# update system's info root@dlp:~# rkhunter --propupd
# run checking # --sk means skip to push Enter key # --rwo means display only warnings root@dlp:~# rkhunter --check --sk
[ Rootkit Hunter version 1.4.0 ] Checking system commands... Performing 'strings' command checks Checking 'strings' command [ OK ] Performing 'shared libraries' checks Checking for preloading variables [ None found ] Checking for preloaded libraries [ None found ] Checking LD_LIBRARY_PATH variable [ Not found ] Performing file properties checks Checking for prerequisites [ OK ] /usr/sbin/adduser [ OK ] /usr/sbin/chroot [ OK ] /usr/sbin/cron [ OK ] /usr/sbin/groupadd [ OK ] /usr/sbin/groupdel [ OK ] ..... ..... System checks summary ===================== File properties checks... Files checked: 133 Suspect files: 1 Rootkit checks... Rootkits checked : 305 Possible rootkits: 0 Applications checks... All checks skipped The system checks took: 47 seconds All results have been written to the log file: /var/log/rkhunter.log One or more warnings have been found while checking the system. Please check the log file (/var/log/rkhunter.log) |