Rkhunter - Revision history

Christoph at 21:38, 10 September 2021

2021-09-10T21:38:50Z

Christoph: /* Installation and usage */

2021-09-10T21:32:42Z

‎Installation and usage

Christoph: New page: '''`rkhunter`''' (aka '''Rootkit Hunter''') is a rootkit, backdoor, sniffer, and exploit scanner. It scans systems for known and unknown rootkits, backdoors, sniffers and exploits. ...

2014-08-13T11:17:11Z

New page: '''<tt>rkhunter</tt>''' (aka '''Rootkit Hunter''') is a rootkit, backdoor, sniffer, and exploit scanner. It scans systems for known and unknown rootkits, backdoors, sniffers and exploits. ...

New page

'''<tt>rkhunter</tt>''' (aka '''Rootkit Hunter''') is a rootkit, backdoor, sniffer, and exploit scanner. It scans systems for known and unknown rootkits, backdoors, sniffers and exploits.

It checks for:
* MD5 hash changes;
* files commonly created by rootkits;
* executables with anomalous file permissions;
* suspicious strings in kernel modules;
* hidden files in system directories; and
* can optionally scan within files.

''NOTE: Using `rkhunter` alone does not guarantee that a system is not compromised. Running additional tests, such as [[chkrootkit]], is recommended.''

==Installation and usage==
On [[CentOS]] systems, `rkhunter` can be installed from the EPEL repositories. If you do not have EPEL installed, you can get it setup by (for CentOS 6.x):
$ rpm -ivh <nowiki>http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm</nowiki>

* Install `rkhunter`:
$ yum install rkhunter

* Configure `rkhunter` to send email if a "warning" is found during a given scan:
$ vi /etc/rkhunter.conf
# Change
MAIL-ON-WARNING=""
# To
MAIL-ON-WARNING="bob@example.com"

* Finally, fetch the latest updates, create a baseline, and run an on-demand scan:
$ rkhunter --update
$ rkhunter --propupd
$ rkhunter -sk -c

You can also configure `rkhunter` to run automatically (via a cronjob) daily. On CentOS systems, there should already be a script for this:
$ cat /etc/cron.daily/rkhunter

Now, all you need to do is update the `rkhunter` configuration with your actual email address so you can receive the nightly reports:
$ vi /etc/sysconfig/rkhunter
# Change
MAILTO=root@localhost
# To
MAILTO=bob@example.com

==External links==
* [http://rkhunter.sourceforge.net/ Official website]
* [https://community.rackspace.com/general/f/34/t/75 Investigating Compromised Servers]

[[Category:Linux Command Line Tools]]

@@ Line 9: / Line 9: @@
 * can optionally scan within files.
-''NOTE: Using `rkhunter` alone does not guarantee that a system is not compromised. Running additional tests, such as [[chkrootkit]], is recommended.''
+''NOTE: Using <code>rkhunter</code> alone does not guarantee that a system is not compromised. Running additional tests, such as [[chkrootkit]], is recommended.''
 ==Installation and usage==
@@ Line 50: / Line 50: @@
    Latest version: 1.4.6
 </pre>
 ==External links==

@@ Line 12: / Line 12: @@
 ==Installation and usage==
-On [[CentOS]] systems, `rkhunter` can be installed from the EPEL repositories. If you do not have EPEL installed, you can get it setup by (for CentOS 6.x):
+On [[CentOS]] systems, <code>rkhunter</code> can be installed from the EPEL repositories. If you do not have EPEL installed, you can get it setup by (for CentOS 6.x):
   $ rpm -ivh <nowiki>http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm</nowiki>
-* Install `rkhunter`:
+* Install <code>rkhunter</code>:
   $ yum install rkhunter
-* Configure `rkhunter` to send email if a "warning" is found during a given scan:
+* Configure <code>rkhunter</code> to send email if a "warning" is found during a given scan:
   $ vi /etc/rkhunter.conf
   # Change
@@ Line 30: / Line 30: @@
   $ rkhunter -sk -c
-You can also configure `rkhunter` to run automatically (via a cronjob) daily. On CentOS systems, there should already be a script for this:
+You can also configure <code>rkhunter</code> to run automatically (via a cronjob) daily. On CentOS systems, there should already be a script for this:
   $ cat /etc/cron.daily/rkhunter
-Now, all you need to do is update the `rkhunter` configuration with your actual email address so you can receive the nightly reports:
+Now, all you need to do is update the <code>rkhunter</code> configuration with your actual email address so you can receive the nightly reports:
   $ vi /etc/sysconfig/rkhunter
   # Change
@@ Line 39: / Line 39: @@
   # To
   MAILTO=bob@example.com
 ==External links==

Rkhunter - Revision history

Christoph at 21:38, 10 September 2021

Christoph: /* Installation and usage */

Christoph: New page: '''rkhunter''' (aka '''Rootkit Hunter''') is a rootkit, backdoor, sniffer, and exploit scanner. It scans systems for known and unknown rootkits, backdoors, sniffers and exploits. ...

Christoph: New page: '''`rkhunter`''' (aka '''Rootkit Hunter''') is a rootkit, backdoor, sniffer, and exploit scanner. It scans systems for known and unknown rootkits, backdoors, sniffers and exploits. ...