RKHunter : インストール2024/09/09 |
Rootkit 検出ツール RKHunter のインストールと設定です。 |
|
[1] | RKHunter をインストールします。 |
root@dlp:~ # pkg install -y rkhunter curl
|
[2] | RKHunter の設定と利用方法です。 |
root@dlp:~ #
vi /etc/periodic.conf # 新規作成 # 日次のデータベースアップデートを有効にする security_rkhunter_update_enable="YES" security_rkhunter_update_period="daily" security_rkhunter_update_flags="--update --nocolors" # 日次でシステムチェックする場合は以下を追記 security_rkhunter_check_enable="YES" security_rkhunter_check_period="daily" security_rkhunter_check_flags="--checkall --nocolors --skip-keypress" # データベースをアップデート root@dlp:~ # rkhunter --update [ Rootkit Hunter version 1.4.6 ] Checking rkhunter data files... Checking file mirrors.dat [ Updated ] Checking file programs_bad.dat [ No update ] Checking file backdoorports.dat [ No update ] Checking file suspscan.dat [ No update ] Checking file i18n/cn [ No update ] Checking file i18n/de [ No update ] Checking file i18n/en [ No update ] Checking file i18n/tr [ No update ] Checking file i18n/tr.utf8 [ No update ] Checking file i18n/zh [ No update ] Checking file i18n/zh.utf8 [ No update ] Checking file i18n/ja [ No update ] # システムのファイル情報をアップデート root@dlp:~ # rkhunter --propupd [ Rootkit Hunter version 1.4.6 ] File created: searched for 173 files, found 122 # チェック実行 # --sk で Enterキー押下をスキップ # --rwo を指定すると、警告のみ表示 root@dlp:~ # rkhunter --check --sk
[ Rootkit Hunter version 1.4.6 ] Checking system commands... Performing 'strings' command checks Checking 'strings' command [ OK ] Performing 'shared libraries' checks Checking for preloading variables [ None found ] Checking for preloaded libraries [ None found ] Checking LD_LIBRARY_PATH variable [ Not found ] Performing file properties checks Checking for prerequisites [ OK ] /sbin/dmesg [ OK ] /sbin/fsck [ OK ] /sbin/ifconfig [ OK ] /sbin/init [ OK ] /sbin/md5 [ OK ] /sbin/md5sum [ OK ] /sbin/mount [ OK ] /sbin/nologin [ OK ] /sbin/ping [ OK ] /sbin/route [ OK ] /sbin/sha1 [ OK ] /sbin/sha1sum [ OK ] /sbin/sha224 [ OK ] /sbin/sha224sum [ OK ] /sbin/sha256 [ OK ] /sbin/sha256sum [ OK ] /sbin/sha384 [ OK ] ..... ..... System checks summary ===================== File properties checks... Files checked: 122 Suspect files: 0 Rootkit checks... Rootkits checked : 498 Possible rootkits: 0 Applications checks... All checks skipped The system checks took: 38 seconds All results have been written to the log file: /var/log/rkhunter.log No warnings were found while checking the system. |
|