Securing Centos and cpanel from root kits using rkhunter (root kit hunter)

February 7th, 2009 shk 0 Comments

Security of your web server is one of the more important issue now a days….Risk of your server security increaseswith the increase in popularity of your websites and your service.. Here is an article to teach you that how you can protect your server from rootkits..

root kit hunter is one of the best root kit scanner I found in my experience..

You can check its updates at

http://rootkit.nl/projects/rootkit_hunter.html

To install rootkit hunter, you need to login to your server with root login and download

# wget http://downloads.sourceforge.net/project/rkhunter/rkhunter/1.3.8/rkhunter-1.3.8.tar.gz
# tar - xzvf rkhunter-1.3.8.tar.gz
# cd rkhunter-1.3.8.tar.gz
# ./installer.sh --layout default --install
# cd ..
# rm -Rf rkhunter*
# /usr/local/bin/rkhunter --update
# /usr/local/bin/rkhunter --propupd

Now cron it to run on daily basis and email you

# nano -w /etc/cron.daily/rkhunter.sh

#!/bin/sh
(
/usr/local/bin/rkhunter --versioncheck
/usr/local/bin/rkhunter --update
/usr/local/bin/rkhunter --cronjob --report-warnings-only
) | /bin/mail -s 'rkhunter Daily Run (YourServerNameHere)' your@email.com

Remember to change YourServerNameHere and your@email.com