Generation Libre

rkhunter est un programme permettant de détecter si le
système n’a pas été compromis par un rootkit, une backdoor ou un
sniffer.

L’installation est trés simple:

pcmarty:~/rkhunter# wget http://downloads.rootkit.nl/rkhunter-1.2.8.tar.gz
pcmarty:~/rkhunter# tar -zxvf rkhunter-1.2.8.tar.gz
pcmarty:~/# cd rkhunter
pcmarty:~/rkhunter# ./installer.sh

Si tout c’est bien passé:

Installation ready. See /usr/local/rkhunter/lib/rkhunter/docs for more information. Run ‘rkhunter’ (/usr/local/bin/rkhunter)

Pour voir les options, lancez la commande:

pcmarty:~/# rkhunter

Rootkit Hunter 1.2.8, Copyright 2003-2005, Michael Boelen
Rootkit Hunter comes with ABSOLUTELY NO WARRANTY. This is free software,

and you are welcome to redistribute it under the terms of the GNU General
Public License. See LICENSE for details.
Valid parameters:
–checkall (-c) : Check system
–createlogfile : Create logfile
–cronjob : Run as cronjob (removes colored layout)
–display-logfile : Show logfile at end of the output
–help (-h) : Show this help
–nocolors : Don’t use colors for output
–report-mode : Don’t show uninteresting information for reports
–report-warnings-only : Show only warnings (lesser output than report-mode,more than –quiet)
–skip-application-check : Don’t run application version checks
–skip-keypress : Don’t wait after every test (non-interactive)
–quick : Perform quick scan (instead of full scan)
–quiet : Be quiet (only show warnings)
–update : Run update tool and check for database updates
–version : Show version and quit
–versioncheck : Check for latest version
–bindir <bindir> : Use <bindir> instead of using default binaries
–configfile <file> : Use different configuration file
–dbdir <dir> : Use <dbdir> as database directory
–rootdir <rootdir> : Use <rootdir> instead of / (slash at end)
–tmpdir <tempdir> : Use <tempdir> as temporary directory

Explicit scan options:
–allow-ssh-root-user : Allow usage of SSH root user login
–disable-md5-check : Disable MD5 checks
–disable-passwd-check : Disable passwd/group checks
–scan-knownbad-files : Perform besides ‘known good’ check a ‘known bad’ check
Multiple parameters are allowed

Parameter can only be used with other parameters

Une fois installé, n’oublions pas de faire une mise a jour de la base:

pcmarty:~/# rkhunter –update

Running updater…

Mirrorfile /usr/local/rkhunter/lib/rkhunter/db/mirrors.dat rotated
Using mirror http://www.rootkit.nl/rkhunter
[DB]
Mirror
file
: Up to date
[DB] MD5 hashes system binaries : Update available
Action: Database updated (current version: 2005051900, new version 2005101300)
[DB] Operating System information : Update available
Action: Database updated (current version: 2005052200, new version 2005102800)
[DB] MD5 blacklisted tools/binaries : Up to date
[DB] Known good program versions : Update available
Action: Database updated (current version: 2005041700, new version 2005103100)
[DB] Known bad program versions : Update available
Action: Database updated (current version: 2005041700, new version 2005103100)

Ready.

Lancez ensuite un petit scan selon les options vues plus haut.

Exemple:

pcmarty:~/# rkhunter -c –report-mode –quiet
Line:
[ Warning! ]
Line: \033[31C[ Warning! ]

Watch out Root login possible. Possible risk!
MD5 scan
MD5 compared : 0
Incorrect MD5 checksums : 0

File scan
Scanned files: 342
Possible infected files: 0

Rootkits
Possible rootkits:

Scanning took 49 seconds

important
Scan your system sometimes manually with full output enabled!
Some errors has been found while checking.
Please perform a manual check on this machine pcmarty

Ici on peut voir que je n’ai pas de rootkit ou autre… mais un
avertissement sur le fait que l’acces a ma machine en root est possible
via SSH :p

Vérifier la version:

pcmarty:~/# rkhunter –versioncheck
http://mirror01.mirror.rkhunter.org/rkhunter_latest.dat

Rootkit Hunter 1.2.8, copyright Michael Boelen

This version: 1.2.8
Latest version: 1.2.8

Mettre a jour sa base quotidiennement:

Pour cela, nous allons utiliser simplement le crontab

pcmarty:~/# crontab -e

Saisissez ceci:

00 23 root rkhunter –update

Pour effectuer une mise à jour tous les jours à 23h00.

Faites en de même pour lancer un scan, juste en rajoutant l’option
–cronjob. ou tout simplement en creant un script dans /etc/cron.daily:

#!/bin/sh
(
/usr/local/bin/rkhunter –versioncheck
/usr/local/bin/rkhunter –update
/usr/local/bin/rkhunter –cronjob –report-warnings-only
) | /bin/mail -s ‘Scan rkhunter’ mon_adress@domain.com