CentOS How To's Network Security

How to Install RkHunter for Rootkit/Trojan Scanning on CentOS/RHEL

Rootkit Hunter (rkhunter) is a Unix-based tool that scans for rootkits, backdoors and possible local exploits. It does this by comparing SHA-1 hashes of important files with known good ones in online database as well as:

  • MD5 hash compare
  • Look for default files used by rootkits
  • Wrong file permissions for binaries
  • Look for suspected strings in LKM and KLD modules
  • Look for hidden files
  • Optional scan within plaintext and binary files

 

1. Installation

1.1 Download Rootkit Hunter

Begin by downloading the latest stable version of Rkhunter by using the Wget command. The /usr/local/src folder is where you should put any programs (source or binary) you’ve downloaded before installing them.

Make sure to check for the latest available version hereand append the instructions above accordingly.


1.2 Installation Rootkit Hunter

Once you have downloaded the latest version of Rootkit Hunder, issue the following commands as root to start the installation routine.

 

2 Setup a Cronjob

Cronjobs enable scheduled scanning of your file system and send email notifications to specified your email id

2.1: Create run-file in the following location (RHEL based distributions only):

 

2.2: You need to insert a short shell script to the rkhunter.sh file we have just created.

Important: Remember to change: (PutYourServerNameHere) AND your@email.here to a valid server name / e-mail address

 

2.3: Set execute permission on the file you have just created:

 

3. Update rkhunter

Run the updater by issuing the following command.

 

4. Manual Scan

You can initiate a manual scan by issuing the following command:

Which runs rkhunter in interactive mode. In other words, when it gets to the end of a particular scan, you need to press ‘enter’ to continue. If you want to “auto skip” interactive mode, add the -sk option at the end:

To scan the entire file system enter:

 

Your scan results should look as follows:

 

Congratulations, you have now completed installing and configuring Rootkit Hunter.

Source from by ROServices Blog: www.ro-services.com

 

Enjoy..

I started blogging around 2011 at #Ubuntupirates, #ProjectX and #pir8geek, I’m currently working as Network/Linux SysAdmin.

I’m a Linux,opensource advocate and interested in network security and InfoSec.

Leave a Reply