Rkhunter (Rootkit Hunter) is a Unix-based tool that scans for rootkits, backdoors and possible local exploits. It does this by comparing MD5 hashes of important files with known good ones in online database, searching for default directories (of rootkits), wrong permissions, hidden files, suspicious strings in kernel modules, and special tests for Linux and FreeBSD.
Step 1: Downloading, Installing and Updating
cd /usr/local/src wget http://sourceforge.net/projects/rkhunter/files/rkhunter/1.4.6/rkhunter-1.4.6.tar.gz wget http://sourceforge.net/projects/rkhunter/files/rkhunter/1.4.6/rkhunter-1.4.6.tar.gz.sha1 wget http://sourceforge.net/projects/rkhunter/files/rkhunter/1.4.6/rkhunter-1.4.6.tar.gz.asc sha1sum -c rkhunter-1.4.6.tar.gz.sha1.txt tar -zxvf rkhunter-1.4.6.tar.gz cd rkhunter-1.4.6 ./installer.sh --layout default --install /usr/local/bin/rkhunter --update /usr/local/bin/rkhunter --propupd rm -Rf /usr/local/src/rkhunter* cd
Step 2: Adding daily cron job
Create the file /etc/cron.daily/rkhunter.sh with the following contents.
#!/bin/sh ( /usr/local/bin/rkhunter --versioncheck /usr/local/bin/rkhunter --update /usr/local/bin/rkhunter --cronjob --report-warnings-only ) | /bin/mail -s 'rkhunter Daily Run (YourServerNameHere)' [email protected]
Change YourServerNameHere to your hostname and [email protected] to your mail address.
Correct the permissions.
chmod 700 /etc/cron.daily/rkhunter.sh
Your Server will be scanned regularly and the result will be sent to the mentioned mail address.
