Install RKHunter for RootKit Detection

Guide to Linux Software RAID
August 6, 2016
Install ChkRootKit as Security Scanner
August 6, 2016
Show all

Install RKHunter for RootKit Detection

[1]Install RKHunter.
# install from EPEL

[[email protected] ~]#

yum –enablerepo=epel -y install rkhunter
[2]Configure and Use RKHunter.
For regular checking, checking script is installed under cron.daily directory and it is executed everyday by Cron.
[[email protected] ~]#

vi /etc/sysconfig/rkhunter
# recipient address for report

[email protected]

# if specified “yes”, scan more detaily

DIAG_SCAN=no

# update database

[[email protected] ~]#

rkhunter –update
# update system file properties

[[email protected] ~]#

rkhunter –propupd
# execute checking
# –sk means sikpping to push Enter key
# if specified –rwo , display only warnings

[[email protected] ~]#

rkhunter –check –sk
[ Rootkit Hunter version 1.4.2 ] Checking system commands... Performing 'strings' command checks Checking 'strings' command [ OK ] Performing 'shared libraries' checks Checking for preloading variables [ None found ] Checking for preloaded libraries [ None found ] Checking LD_LIBRARY_PATH variable [ Not found ] Performing file properties checks Checking for prerequisites [ OK ] /usr/sbin/adduser [ OK ] /usr/sbin/chkconfig [ OK ] /usr/sbin/chroot [ OK ] /usr/sbin/depmod [ OK ] /usr/sbin/fsck [ OK ] ..... ..... System checks summary ===================== File properties checks... Files checked: 121 Suspect files: 0 Rootkit checks... Rootkits checked : 365 Possible rootkits: 0 Applications checks... All checks skipped The system checks took: 1 minute and 35 seconds All results have been written to the log file: /var/log/rkhunter/rkhunter.log No warnings were found while checking the system.

 

Reference: https://www.server-world.info/en/note?os=CentOS_7&p=rkhunter

Comments are closed.