RkHunter Installtion

RKHunter [Rootkit Hunter]

====================

RootKit is a feature rich scanning tool that scans for rootkits, backdoors, and local exploits. It scans hidden files, wrong permissions set on binaries, suspicious strings in kernel etc.

As rootkits are installed into system files they cannot be removed easily however, RKHunter will still notify you of any rootkits that may exist in your system so that you can take the necessary steps to reload on server. 

Rootkit Hunter is not a reactive tool: it only enumerates encountered threats.

It is up to you to read the log file and investigate suspicious activity.

To know more about Rkhunter and its features visit http://www.rootkit.nl/.

================================== ==============

Installing Rkhunter (Rootkit Hunter) in RHEL, CentOS and Fedora

================================== ==============

Step 1: Downloading Rkhunter:

[root@server ~]# mkdir /download

[root@server ~]# cd /download

[root@server download]# wget http://nchc.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.0/rkhunter-1.4.0.tar.gz

Step 2: Installing Rkhunter:

Once you have downloaded the latest version, run the following commands as a root user to install it.

[root@server download]# tar -xvzf rkhunter-1.4.0.tar.gz

[root@server download]# cd rkhunter-1.4.0

[root@server rkhunter-1.4.0]# ./installer.sh --install

[root@server rkhunter-1.4.0]# cd 

Step 3: Updating Rkhunter:

Run the RKH updater to fill the database properties by running the following command.

[root@server ~]# /usr/local/bin/rkhunter --update

[root@server ~]# /usr/local/bin/rkhunter --propupd 

Step 4: Setting Cronjob and Email Alerts:

Create one file "rkhunter.sh under /etc/cron.daily/, which then scans your file system every day and sends email notifications to your email id. 

[root@server ~]# vi /etc/cron.daily/rkhunter.sh

#Add the following lines of code to it and replace your “Server Name” and your “Email Id“.

#!/bin/sh

(

/usr/local/bin/rkhunter --versioncheck

/usr/local/bin/rkhunter --update

/usr/local/bin/rkhunter --cronjob --report-warnings-only

) | /bin/mail -s 'rkhunter Daily Run (server.anup.co.in)' mail@anup.co.in 

Set execute permission on the file.

[root@server ~]# chmod +x /etc/cron.daily/rkhunter.sh 

Step 5: Manual Scan and Usage:

To scan the entire file system, run the Rkhunter as a root user.

[root@server ~]# rkhunter --check

The above command generates log file under /var/log/rkhunter.log with the checks results made by Rkhunter. 

For more information and options please run the following command.

[root@server ~]# rkhunter --help