CHKRootkit installation

Sur DEBIAN

apt-get install chkrootkit

Créer /etc/chkrootkit et y déplacer /etc/chkrootkit.conf Editer /etc/cron.daily/chkrootkit, pour qu'il ressemble à ça :

#!/bin/bash

CHKROOTKIT=/usr/sbin/chkrootkit
CF=/etc/chkrootkit/chkrootkit.conf
EXCLUDEF=/etc/chkrootkit/exclude.list
MAIL=/usr/bin/mail
LOG_DIR=/var/cache/chkrootkit

if [ ! -x $CHKROOTKIT ]; then
  exit 0
fi

if [ -f $CF ]; then
    . $CF
fi

if [ "$RUN_DAILY" = "true" ]; then
    if [ "$DIFF_MODE" = "true" ]; then
        $CHKROOTKIT $RUN_DAILY_OPTS > $LOG_DIR/log.new 2>&1
#        if [ ! -f $LOG_DIR/log.old ] \
#           || ! diff -q $LOG_DIR/log.old $LOG_DIR/log.new > /dev/null 2>&1; then
#            cat $LOG_DIR/log.new
#        fi
        mv $LOG_DIR/log.new $LOG_DIR/log.old
    else
        $CHKROOTKIT $RUN_DAILY_OPTS
    fi
fi
# Mail alert
# No future for empty lines
cat $LOG_DIR/log.old | grep -v -e '^$' > $LOG_DIR/log.alert
# We drop lines listed in $EXCLUDEF by suppress them line by line
while read LINE
do
   cat $LOG_DIR/log.alert | grep -v "$LINE" > $LOG_DIR/log.alert
done < /etc/chkrootkit/exclude.list
# If some alerts stay in file, we cry
if [ -s $LOG_DIR/log.alert ]
then
        (echo "CHKROOTKIT Alert :"
         cat $LOG_DIR/log.alert
        ) | $MAIL -s 'chkrootkit Daily Run' $REPORT_MAIL
fi

Editer /etc/chkrootkit/chkrootkit.conf, modifier :

RUN_DAILY="true"
RUN_DAILY_OPTS="-q" # -q=quiet mode
DIFF_MODE="true" # garde un /var/cache/chkrootkit/log.old pour comparer la prochaine fois

et y ajouter

REPORT_MAIL=fsoyer@systea.net

Et enfin créer /etc/chkrootkit/exclude.list et y ajouter les phrases à exclure du mail d'alerte, exemple :

The following suspicious files and directories were found:
/lib/init/rw/.ramfs
INFECTED (PORTS:  465)
eth0: PACKET SNIFFER(/usr/sbin/snort