RKHunter Rootkit Detect
Autor: Thiago Laurito | Publicado: 2012-04-22T00:35:00-03:00

Neste artigo vou falar sobre uma ótima ferramenta para detecção de rootkit no sistema, além de detectar rootkits ela também informa de alguma má configuração no S.O que pode comprometer a integridade do mesmo.

Efetue o Download do Build:

http://downloads.sourceforge.net/rkhunter/rkhunter-1.3.8.tar.gz

http://slackbuilds.org/slackbuilds/13.37/system/rkhunter.tar.gz

Após efetuar o processo de instalação vamos efetuar o update e a primeira checagem no nosso S.O.

root@boot-v1:~# rkhunter --update 
[ Rootkit Hunter version 1.3.8 ]

Checking rkhunter data files...
&nbsp; Checking file mirrors.dat&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [ No update ]
&nbsp; Checking file programs_bad.dat&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [ No update ]
&nbsp; Checking file backdoorports.dat&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp; [ No update ]
&nbsp; Checking file suspscan.dat&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [ No update ]
&nbsp; Checking file i18n/cn&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [ No update ]
&nbsp; Checking file i18n/de&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [ No update ]
&nbsp; Checking file i18n/en&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [ No update ]
&nbsp; Checking file i18n/zh&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [ No update ]
&nbsp; Checking file i18n/zh.utf8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [ No update ]


Vamos efetuar uma checagem:
root@boot-v1:~# rkhunter -c

Vamos automatizar um simples script e acrestar no cron:

root@boot-v1:/tmp# cat rkhunterexec.sh 

#!/bin/bash

( /usr/bin/rkhunter --versioncheck 
/usr/bin/rkhunter --update 
/usr/bin/rkhunter --cronjob --report-warnings-only) | /usr/bin/mail -s "Rkhunter Output" thiago.laurito@gmail.com


Este script vai fazer as rotinas de update do database e versão.

Vamos adicioná-lo cron:

00 23 * * * /etc/scripts/rkhunter-script.sh -c --cronjob
&nbsp;
Segue um log após checagem:
&nbsp;
root@boot-v1:/var/log# tail -f rkhunter.log
[00:30:50] Rootkits checked : 251
[00:30:50] Possible rootkits: 0
[00:30:50]
[00:30:50] Applications checks...
[00:30:50] Applications checked: 6
[00:30:50] Suspect applications: 0
[00:30:50]
[00:30:50] The system checks took: 3 minutes and 25 seconds
[00:30:50]
[00:30:50] Info: End date is Sun Apr 22 00:30:50 BRT 2012
&nbsp;