Support
Forums
Contact Me
Download
Demo
chkrootkit
- Details
- Category: security
- Published on Friday, 20 July 2007 00:46
- Written by Administrator
- Hits: 8843
Log to the server with
Download chkrootkit.
Unpack the chkrootkit you just downloaded.
go to that directory
Compile
Run
* the correct path can be found with
This will run chkrootkit at 3:00 am every day, and e-mail the output to
False alarms:
ssh as root userDownload chkrootkit.
# wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gzUnpack the chkrootkit you just downloaded.
# tar xvzf chkrootkit.tar.gzgo to that directory
# cd chkrootkitCompile
# make senseRun
# chkrootkitReceive e-mail everyday with the result chkrootkit
For Root user
For any user
and add
For Root user
# crontab -e For any user
# crontab -e -u usernameand add
0 3 * * * (./usr/sbin/chkrootkit 2>&1 | mail -s "chkrootkit output" -c
This email address is being protected from spambots. You need JavaScript enabled to view it.
,
This email address is being protected from spambots. You need JavaScript enabled to view it.
This email address is being protected from spambots. You need JavaScript enabled to view it.
)
* the correct path can be found with
which chkrootkit This will run chkrootkit at 3:00 am every day, and e-mail the output to
This email address is being protected from spambots. You need JavaScript enabled to view it.
and copies to
This email address is being protected from spambots. You need JavaScript enabled to view it.
and
This email address is being protected from spambots. You need JavaScript enabled to view it.
"Checking `bindshell'... INFECTED (PORTS: 465)" This is normal and NOT really a rootkit.
Nota
If you ever get a positive alarm, you can try to remove the rootkit, but all professionals would advice you to reinstall the server from scratch, and restore a previous backup (that mean saving nothing from server as soon as the rootkit is revealed....)
chkrootkit
You might also like:
47 days ago
The Appthority® App Report
The Appthority® App Report for February 2013 provides an overview of the security risks behind 10
91 days ago
CryptoParty Handbook v1.1 has been released
CryptoParty is a grassroots global endeavor to introduce the basics of practical cryptography such
1739 days ago
Virtualizes a Linux server on the fly with RSYNC
You'll need a lot of patience...Since there is no VMWARE Converter for Linux...My objec
1847 days ago
How to Secure Your Windows Computer and Protect Your Privacy
Anybody using internet should really read this article. While targeted at windows users, most of the
1908 days ago
Secure, Safe, Fast Linux Hosting
I know that Secure, Safe, Fast Linux Hosting sound silly as nothing can be fast and secure at the sa
2033 days ago
Security made easy, automatic scan and update of your instal
If you are on the paranoia side, and you better should, if you're using ebanking on an internet co
Donations
Thank You for supporting my work
My Other Sites
Services
Joomla!
WEB 2.0
Fun
Skype
Need desperately help?
But dont abuse of it!
But dont abuse of it!