RKHunter : Detect Rootkit

RKHunter : Detect Rootkit 2015/07/08

	Install RKHunter which is the Rootkit Detection tool.
[1]	Install RKHunter.

# install from EPEL [root@dlp ~]#  yum --enablerepo=epel -y install rkhunter

[2]	Configure and Use RKHunter. For regular checking, checking script is installed under cron.daily directory and it is executed everyday by Cron.

[root@dlp ~]#  vi /etc/sysconfig/rkhunter # recipient address for report MAILTO=root@localhost # if specified "yes", scan more detaily DIAG_SCAN=no # update database [root@dlp ~]#  rkhunter --update # update system file properties [root@dlp ~]#  rkhunter --propupd # execute checking # --sk means sikpping to push Enter key # if specified --rwo , display only warnings [root@dlp ~]#  rkhunter --check --sk [ Rootkit Hunter version 1.4.2 ] Checking system commands... Performing 'strings' command checks Checking 'strings' command [ OK ] Performing 'shared libraries' checks Checking for preloading variables [ None found ] Checking for preloaded libraries [ None found ] Checking LD_LIBRARY_PATH variable [ Not found ] Performing file properties checks Checking for prerequisites [ OK ] /usr/sbin/adduser [ OK ] /usr/sbin/chkconfig [ OK ] /usr/sbin/chroot [ OK ] /usr/sbin/depmod [ OK ] /usr/sbin/fsck [ OK ] ..... ..... System checks summary ===================== File properties checks... Files checked: 121 Suspect files: 0 Rootkit checks... Rootkits checked : 365 Possible rootkits: 0 Applications checks... All checks skipped The system checks took: 1 minute and 35 seconds All results have been written to the log file: /var/log/rkhunter/rkhunter.log No warnings were found while checking the system.