How to Install RkHunter for Rootkit/Trojan Scanning on CentOS/RHEL

Rootkit Hunter (rkhunter) is a Unix-based tool that scans for rootkits, backdoors and possible local exploits. It does this by comparing SHA-1 hashes of important files with known good ones in online database as well as:

MD5 hash compare
Look for default files used by rootkits
Wrong file permissions for binaries
Look for suspected strings in LKM and KLD modules
Look for hidden files
Optional scan within plaintext and binary files

1. Installation

1.1 Download Rootkit Hunter
Begin by downloading the latest stable version of Rkhunter by using the Wget command. The /usr/local/src folder is where you should put any programs (source or binary) you’ve downloaded before installing them.

cd /usr/local/src
wget http://dfn.dl.sourceforge.net/sourceforge/rkhunter/rkhunter-1.4.0.tar.gz
wget http://dfn.dl.sourceforge.net/sourceforge/rkhunter/rkhunter-1.4.0.tar.gz.sha1.txt
sha1sum -c rkhunter-1.4.0.tar.gz.sha1.txt

Make sure to check for the latest available version here, and append the instructions above accordingly.

1.2 Installation Rootkit Hunter
Once you have downloaded the latest version of Rootkit Hunder, issue the following commands as root to start the installation routine.

tar -zxvf rkhunter-1.4.0.tar.gz
cd rkhunter-1.4.0
./installer.sh --layout default --install 
/usr/local/bin/rkhunter --update
/usr/local/bin/rkhunter --propupd
rm -Rf /usr/local/src/rkhunter*

2 Setup a Cronjob

Cronjobs enable scheduled scanning of your file system and send email notifications to specified your email id
2.1: Create run-file in the following location (RHEL based distributions only):

nano -w /etc/cron.daily/rkhunter.sh

2.2: You need to insert a short shell script to the rkhunter.sh file we have just created.

#!/bin/sh
(
/usr/local/bin/rkhunter --versioncheck
/usr/local/bin/rkhunter --update
/usr/local/bin/rkhunter --cronjob --report-warnings-only
) | /bin/mail -s 'rkhunter Daily Run (PutYourServerNameHere)' [email protected]

Important: Remember to change: (PutYourServerNameHere) AND [email protected] to a valid server name / e-mail address

2.3: Set execute permission on the file you have just created:

chmod 755 /etc/cron.daily/rkhunter.sh

3. Update rkhunter

Run the updater by issuing the following command.

# /usr/local/bin/rkhunter --update
# /usr/local/bin/rkhunter --propupd

4. Manual Scan

You can initiate a manual scan by issuing the following command:

/usr/local/bin/rkhunter -c

Which runs rkhunter in interactive mode. In other words, when it gets to the end of a particular scan, you need to press ‘enter’ to continue. If you want to “auto skip” interactive mode, add the -sk option at the end:

/usr/local/bin/rkhunter -c -sk

To scan the entire file system enter:

rkhunter --check

Your scan results should look as follows:

---------------------------- Scan results ----------------------------
MD5 scan
Scanned files: 0
Incorrect MD5 checksums: 0
File scan
Scanned files: 412
Possible infected files: 0
Application scan
Vulnerable applications: 0
Scanning took 39 seconds
-----------------------------------------------------------------------

Congratulations, you have now completed installing and configuring Rootkit Hunter.
Source from by ROServices Blog: www.ro-services.com

Enjoy..

James Eduard

James Eduard