Posted by yolau

What is chkrootkit?

chkrootkit is a tool to locally check for signs of a rootkit.  It
contains:

* chkrootkit: a shell script that checks system binaries for
   rootkit modification.

* ifpromisc.c: checks if the network interface is in promiscuous
   mode.

* chklastlog.c: checks for lastlog deletions.

* chkwtmp.c: checks for wtmp deletions.

* check_wtmpx.c: checks for wtmpx deletions.  (Solaris only)

* chkproc.c: checks for signs of LKM trojans.

* chkdirs.c: checks for signs of LKM trojans.

* strings.c: quick and dirty strings replacement.

* chkutmp.c: checks for utmp deletions.

How to install chkrootkit

1. Login to your server as root
2. Download chkrootkit and extract the archive

wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz
tar xvzf chkrootkit.tar.gz
cd chkrootkit-0.47

3. Install chkrootkit

make sense

4. Now lets run chkrootkit

/root/chkrootkit-0.47/chkrootkit

Make sure you run it on a regular basis, perhaps you can include the scan in a cron job.

If you enjoyed this post, make sure you subscribe to my RSS feed!