ルートキット検出ツール Rootkit Hunter (rkhunter)

# Rootkit Hunter
http://rkhunter.sourceforge.net/
Linux の著名なルートキット検出ツールで、同様のツールとして [chkrootkit](http://qiita.com/bezeklik/items/7964ce67f1a1363b694e) がある。
最新版は 2014/02/24 リリースの **1.4.2** になる。

# インストール
```bash
yum install epel-release
yum install rkhunter unhide
```
unhide は `Checking for hidden processes` で必要。

# アップデート
```bash
rkhunter --update
rkhunter --propupd
```
# 実行
```bash
rkhunter -c --rwo --sk
```

# デフォルト設定ファイル
```bash:/etc/cron.daily/rkhunter
XITVAL=0
TMPFILE1=`/bin/mktemp -p /var/lib/rkhunter rkhcronlog.XXXXXXXXXX` || exit 1
if [ ! -e /var/lock/subsys/rkhunter ]; then
  /bin/touch /var/lock/subsys/rkhunter
  if [ -e /etc/sysconfig/rkhunter ] ; then
    . /etc/sysconfig/rkhunter
  else
    MAILTO=root@localhost
  fi
  if [ "$DIAG_SCAN" = "yes" ]; then
    RKHUNTER_FLAGS="--checkall --skip-keypress --nocolors --quiet --appendlog --display-logfile"
  else
    RKHUNTER_FLAGS="--cronjob --nocolors --report-warnings-only"
  fi
  RKHUNTER=/usr/bin/rkhunter
  LOGFILE=/var/log/rkhunter/rkhunter.log
  if [ -x $RKHUNTER ]; then
    /bin/echo -e "\n--------------------- Start Rootkit Hunter Update ---------------------" \
      > $TMPFILE1
    /bin/nice -n 10 $RKHUNTER --update --nocolors 2>&1 >> $TMPFILE1
    /bin/echo -e "\n---------------------- Start Rootkit Hunter Scan ----------------------" \
      >> $TMPFILE1
    /bin/nice -n 10 $RKHUNTER $RKHUNTER_FLAGS 2>&1 >> $TMPFILE1
    XITVAL=$?
    /bin/echo -e "\n----------------------- End Rootkit Hunter Scan -----------------------" \
      >> $TMPFILE1
    if [ $XITVAL != 0 ]; then
         /bin/cat $TMPFILE1 | /bin/mail -s "rkhunter Daily Run on $(hostname)" $MAILTO
    fi
    /bin/cat $TMPFILE1 >> $LOGFILE
  fi
  /bin/rm -f /var/lock/subsys/rkhunter
fi
/bin/rm -f $TMPFILE1
exit $XITVAL
```
```ini:/etc/sysconfig/rkhunter
# System configuration file for Rootkit Hunter which
# stores RPM system specifics for cron run, etc.
#
#    MAILTO= <email address to send scan report>
# DIAG_SCAN= no  - perform  normal  report scan
#            yes - perform detailed report scan
#                  (includes application check)

MAILTO=root@localhost
DIAG_SCAN=no
```

```ini:/etc/rkhunter.conf
TMPDIR=/var/lib/rkhunter
DBDIR=/var/lib/rkhunter/db
SCRIPTDIR=/usr/share/rkhunter/scripts
LOGFILE=/var/log/rkhunter/rkhunter.log
APPEND_LOG=1
AUTO_X_DETECT=1
ALLOW_SSH_ROOT_USER=unset
ALLOW_SSH_PROT_V1=2
ENABLE_TESTS=ALL
DISABLE_TESTS=suspscan hidden_ports deleted_files packet_cap_apps apps
PKGMGR=RPM
EXISTWHITELIST=/bin/ad
EXISTWHITELIST=/var/log/pki-ca/system
EXISTWHITELIST=/var/log/pki/pki-tomcat/ca/system
EXISTWHITELIST=/usr/bin/GET
EXISTWHITELIST=/usr/bin/whatis
SCRIPTWHITELIST=/usr/bin/whatis
SCRIPTWHITELIST=/usr/bin/ldd
SCRIPTWHITELIST=/usr/bin/groups
SCRIPTWHITELIST=/usr/bin/GET
SCRIPTWHITELIST=/sbin/ifup
SCRIPTWHITELIST=/sbin/ifdown
ALLOWHIDDENDIR="/etc/.java"
ALLOWHIDDENDIR=/dev/.udev
ALLOWHIDDENDIR=/dev/.udevdb
ALLOWHIDDENDIR=/dev/.udev.tdb
ALLOWHIDDENDIR=/dev/.static
ALLOWHIDDENDIR=/dev/.initramfs
ALLOWHIDDENDIR=/dev/.SRC-unix
ALLOWHIDDENDIR=/dev/.mdadm
ALLOWHIDDENDIR=/dev/.systemd
ALLOWHIDDENDIR=/dev/.mount
ALLOWHIDDENDIR=/etc/.git
ALLOWHIDDENDIR=/etc/.bzr
ALLOWHIDDENFILE="/usr/share/man/man1/..1.gz"
ALLOWHIDDENFILE=/lib*/.libcrypto.so.*.hmac
ALLOWHIDDENFILE=/lib*/.libssl.so.*.hmac
ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac
ALLOWHIDDENFILE=/usr/bin/.ssh.hmac
ALLOWHIDDENFILE=/usr/bin/.ssh-keygen.hmac
ALLOWHIDDENFILE=/usr/bin/.ssh-keyscan.hmac
ALLOWHIDDENFILE=/usr/bin/.ssh-add.hmac
ALLOWHIDDENFILE=/usr/bin/.ssh-agent.hmac
ALLOWHIDDENFILE=/usr/lib*/.libfipscheck.so.*.hmac
ALLOWHIDDENFILE=/usr/lib*/.libgcrypt.so.*.hmac
ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha1hmac.hmac
ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha256hmac.hmac
ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha384hmac.hmac
ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha512hmac.hmac
ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
ALLOWHIDDENFILE=/dev/.mdadm.map
ALLOWHIDDENFILE=/usr/share/man/man5/.k5login.5.gz
ALLOWHIDDENFILE=/usr/share/man/man5/.k5identity.5.gz
ALLOWHIDDENFILE=/usr/sbin/.ipsec.hmac
ALLOWHIDDENFILE=/etc/.etckeeper
ALLOWHIDDENFILE=/etc/.gitignore
ALLOWHIDDENFILE=/etc/.bzrignore
ALLOWHIDDENFILE=/etc/.updated
ALLOWDEVFILE=/dev/shm/pulse-shm-*
ALLOWDEVFILE=/dev/md/md-device-map
ALLOWDEVFILE="/dev/shm/mono.*"
ALLOWDEVFILE="/dev/shm/libv4l-*"
ALLOWDEVFILE="/dev/shm/spice.*"
ALLOWDEVFILE="/dev/md/autorebuild.pid"
ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats
ALLOWDEVFILE=/dev/shm/squid-cf*
RTKT_FILE_WHITELIST=/bin/ad
RTKT_FILE_WHITELIST=/var/log/pki-ca/system
RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/ca/system
INSTALLDIR="/usr"
```

# セキュリティ関連記事
* [PHPセキュリティ強化モジュール Suhosin](http://qiita.com/bezeklik/items/5e8b1f76465e39dc6cd0)
* [DoS攻撃/ブルートフォース攻撃対策アプリの近況](http://qiita.com/bezeklik/items/6d86a162e278f576e4ca)
* [Linuxアンチウイルスソフト ClamAV](http://qiita.com/bezeklik/items/4696e15c889ffff6bc41)
* [Linux Malware Detect](http://qiita.com/bezeklik/items/43a7d4fce6bc23fe84d3)
* [ルートキット検出ツール Rootkit Hunter (rkhunter)](http://qiita.com/bezeklik/items/bc7affef8afe7c63f2ce)
* [ルートキット検出ツール chkrootkit](http://qiita.com/bezeklik/items/7964ce67f1a1363b694e)
* [ファイル改ざん検知ツール AFICK](http://qiita.com/bezeklik/items/298dafd2aeb053b4ca88)
* [ファイル改ざん検知ツール AIDE](http://qiita.com/bezeklik/items/d144d77a3e54cd35c06b)
* [脆弱性スキャナー OpenVAS](http://qiita.com/bezeklik/items/a64cad37eb03a1db2de4)
* [Linuxセキュリティ監査ツール Lynis](http://qiita.com/bezeklik/items/cf9be2deb546c69123e7)