How to install and configure Rkhunter on Centos 5, 6, 7

[nidhinjo]

Install RKHunter which is the Rootkit Detection tool.
[1]    Install RKHunter.

Code: [Select]

# install from EPEL

Code: [Select]

[root@dlp ]# yum --enablerepo=epel -y install rkhunter
[2]    Configure and Use RKHunter.
For regular checking, checking script is installed under cron.daily directory and it is executed every day by Cron

Code: [Select]

[root@dlp ~]# vi /etc/sysconfig/rkhunter
# recipient address for the report

MAILTO=root@localhost
# if specified "yes", scan more detaily

DIAG_SCAN=no

[3] update database

Code: [Select]

[root@dlp ~]# rkhunter --update
[4] update system file properties

Code: [Select]

[root@dlp ~]# rkhunter --propupd
[5]execute checking

# --sk means sikpping to push Enter key

# if specified --rwo , display only warnings

Code: [Select]

[root@dlp ~]# rkhunter --check --sk
[ Rootkit Hunter version 1.4.2 ]

Checking system commands...

  Performing 'strings' command checks
    Checking 'strings' command                               [ OK ]

  Performing 'shared libraries' checks
    Checking for preloading variables                        [ None found ]
    Checking for preloaded libraries                         [ None found ]
    Checking LD_LIBRARY_PATH variable                        [ Not found ]

  Performing file properties checks
    Checking for prerequisites                               [ OK ]
    /usr/sbin/adduser                                        [ OK ]
    /usr/sbin/chkconfig                                      [ OK ]
    /usr/sbin/chroot                                         [ OK ]
    /usr/sbin/depmod                                         [ OK ]
    /usr/sbin/fsck                                           [ OK ]

.....
.....


System checks summary
=====================

File properties checks...
    Files checked: 121
    Suspect files: 0

Rootkit checks...
    Rootkits checked : 365
    Possible rootkits: 0

Applications checks...
    All checks skipped

The system checks took: 1 minute and 35 seconds

All results have been written to the log file: /var/log/rkhunter/rkhunter.log

No warnings were found while checking the system.

=============================== ==================================