RootKitScanner

RKHunter

RKHunter is a local security scanner for Linux, Solaris and some other UNIX operating systems. I will describe usage for Ubuntu/Linux here.

Installation

First of all install it to your system:

# aptitude install rkhunter

Update the rule base

After that (and do this from time to time) update the rule base:

# rkhunter --update
[ Rootkit Hunter version 1.4.0 ]

Checking rkhunter data files...
  Checking file mirrors.dat                                  [ No update ]
  Checking file programs_bad.dat                             [ Updated ]
  Checking file backdoorports.dat                            [ No update ]
  Checking file suspscan.dat                                 [ No update ]
  Checking file i18n/cn                                      [ No update ]
  Checking file i18n/de                                      [ Updated ]
  Checking file i18n/en                                      [ Updated ]
  Checking file i18n/tr                                      [ Updated ]
  Checking file i18n/tr.utf8                                 [ Updated ]
  Checking file i18n/zh                                      [ No update ]
  Checking file i18n/zh.utf8                                 [ No update ]

Do the first check

# rkhunter --check --pkgmgr DPKG --skip-keypress --report-warnings-only
Warning: Found enabled inetd service: rstatd/1-5
Warning: syslog-ng configuration file allows remote logging: destination d_logserver { udp("logserver-1"); };
Warning: Suspicious file types found in /dev:
         /dev/.udev/rules.d/root.rules: ASCII text
Warning: Hidden directory found: '/etc/.bzr: directory '
Warning: Hidden directory found: '/dev/.udev: directory '
Warning: Hidden file found: /etc/.bzrignore: ASCII text
Warning: Hidden file found: /etc/.etckeeper: ASCII text
Warning: Hidden file found: /dev/.initramfs: symbolic link to `/run/initramfs'

Many warnings. Check which are false positives and modify your /etc/rkhunter.conf.

Acknowledge false positives

For example to get rid of the warnings above add this lines to the /etc/rkhunter.conf:

ALLOWHIDDENDIR="/dev/.udev"
ALLOWHIDDENDIR="/etc/.bzr"
ALLOWHIDDENFILE="/etc/.bzrignore"
ALLOWHIDDENFILE="/etc/.etckeeper"
ALLOWHIDDENFILE="/dev/.initramfs"
ALLOWDEVFILE="/dev/.udev/rules.d/root.rules"
INETD_ALLOWED_SVC=rstatd/1-5
ALLOW_SYSLOG_REMOTE_LOGGING=1

After that rkhunter should have no output:

# rkhunter --check --pkgmgr DPKG --skip-keypress --report-warnings-only
#

Now you have done your base setup. From now all further output should force you to get a closer look to your system.

Configure ongoing security checks

Configure the user which should get warnings via email in your /etc/rkhunter.conf:

MAIL-ON-WARNING="security-team@yourdomain.tld"