Install CHKROOTKIT
Product Name: CHKROOTKIT
Product Version: 0.50 (and latest)
Homepage: http://www.chkrootkit.org/
Description: chkrootkit (Check Rootkit) is a common Unix-based program intended to help system administrators check their system for known rootkits. It is a shell script using common UNIX/Linux tools like the strings and grep commands to search core system programs for signatures and for comparing a traversal of the /proc filesystem with the output of the ps (process status) command to look for discrepancies.
It can be used from a “rescue disc” (typically a LiveCD) or it can optionally use an alternative directory from which to run all of its own commands. These techniques allow chkrootkit to trust the commands upon which it depends a bit more.
There are inherent limitations to the reliability of any program that attempts to detect compromises (such as rootkits and computer viruses). Newer rootkits may specifically attempt to detect and compromise copies of the chkrootkit programs or take other measures to evade detection by them.
Step 1: Downloading and Installing it:
Code:
cd /usr/local/src
wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz
wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.md5 md5sum -c chkrootkit.md5
tar -zxvf chkrootkit.tar.gz
mkdir /usr/local/chkrootkit
mv /usr/local/src/chkrootkit*/* /usr/local/chkrootkit
cd /usr/local/chkrootkit
make sense Step 2: Adding program to daily cron job
There you go! should be installed, and you will get a mail daily with a status on your system
Code:
nano -w /etc/cron.daily/chkrootkit.sh Step 2.1: Add this text to the chkrootkit.sh file
Code:
#!/bin/sh
(
/usr/local/chkrootkit/chkrootkit
) | /bin/mail -s ‘CHROOTKIT Daily Run (PutServerNameHere)’ your@email.here Remember to change PutServerNameHere and your@email.here
Step 2.2: Chmodding chkrootkit
Code:
chmod 700 /etc/cron.daily/chkrootkit.sh Optional config 1: Make the content of the email report focus on possible threats only
Code:
nano -w /etc/cron.daily/chkrootkit.sh Add a -q after the /usr/local/chkrootkit/chkrootkit line
Code:
usr/local/chkrootkit/chkrootkit -q
