Rkhunter: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
Zeile 141: | Zeile 141: | ||
vi /etc/default/rkhunter | vi /etc/default/rkhunter | ||
CRON_DAILY_RUN="no" | CRON_DAILY_RUN="no" | ||
+ | |||
+ | =Warnungen= | ||
+ | Warning: The file 'xxxx' exists on the system, but it is not present in the rkhunter.dat file. | ||
+ | Abhilfe: rkhunter --propupd |
Version vom 18. November 2013, 15:30 Uhr
Installation
apt-get install rkhunter
Bei Ubuntu 12.04 wird rkhunter 1.4.+X empfohlen
dpkg -i rkhunter_1.4.0-1_all.deb
Parameter
Usage: rkhunter {--check | --unlock | --update | --versioncheck |
--propupd [{filename | directory | package name},...] | --list [{tests | {lang | languages} | rootkits | perl | propfiles}] | --config-check | --version | --help} [options]
Current options are:
--append-log Append to the logfile, do not overwrite --bindir <directory>... Use the specified command directories -c, --check Check the local system -C, --config-check Check the configuration file(s), then exit --cs2, --color-set2 Use the second color set for output --configfile <file> Use the specified configuration file --cronjob Run as a cron job (implies -c, --sk and --nocolors options) --dbdir <directory> Use the specified database directory --debug Debug mode (Do not use unless asked to do so) --disable <test>[,<test>...] Disable specific tests (Default is to disable no tests) --display-logfile Display the logfile at the end --enable <test>[,<test>...] Enable specific tests (Default is to enable all tests) --hash {MD5 | SHA1 | SHA224 | SHA256 | SHA384 | SHA512 | NONE | <command>} Use the specified file hash function (Default is SHA1, then MD5) -h, --help Display this help menu, then exit --lang, --language <language> Specify the language to use (Default is English) --list [tests | languages | List the available test names, languages, rootkits | perl | rootkit names, perl module status propfiles] or file properties database, then exit -l, --logfile [file] Write to a logfile (Default is /var/log/rkhunter.log) --noappend-log Do not append to the logfile, overwrite it --nocf Do not use the configuration file entries for disabled tests (only valid with --disable) --nocolors Use black and white output --nolog Do not write to a logfile --nomow, --no-mail-on-warning Do not send a message if warnings occur --ns, --nosummary Do not show the summary of check results --novl, --no-verbose-logging No verbose logging --pkgmgr {RPM | DPKG | BSD | Use the specified package manager to obtain or SOLARIS | NONE} verify file property values. (Default is NONE) --propupd [file | directory | Update the entire file properties database, package]... or just for the specified entries -q, --quiet Quiet mode (no output at all) --rwo, --report-warnings-only Show only warning messages --sk, --skip-keypress Don't wait for a keypress after each test --summary Show the summary of system check results (This is the default) --syslog [facility.priority] Log the check start and finish times to syslog (Default level is authpriv.notice) --tmpdir <directory> Use the specified temporary directory --unlock Unlock (remove) the lock file --update Check for updates to database files --vl, --verbose-logging Use verbose logging (on by default) -V, --version Display the version number, then exit --versioncheck Check for latest version of program -x, --autox Automatically detect if X is in use -X, --no-autox Do not automatically detect if X is in use
configfile
vi /etc/rkhunter.conf
ROTATE_MIRRORS=1 UPDATE_MIRRORS=1 MIRRORS_MODE=0 MAIL-ON-WARNING="" MAIL_CMD=mail -s "[rkhunter] Warnings found for ${HOST_NAME}" TMPDIR=/var/lib/rkhunter/tmp DBDIR=/var/lib/rkhunter/db SCRIPTDIR=/usr/share/rkhunter/scripts UPDATE_LANG="" LOGFILE=/var/log/rkhunter.log APPEND_LOG=0 COPY_LOG_ON_ERROR=0 COLOR_SET2=0 AUTO_X_DETECT=1 WHITELISTED_IS_WHITE=0 ALLOW_SSH_ROOT_USER=yes ALLOW_SSH_PROT_V1=0 ENABLE_TESTS="all" DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps apps" SCRIPTWHITELIST=/bin/egrep SCRIPTWHITELIST=/bin/fgrep SCRIPTWHITELIST=/bin/which SCRIPTWHITELIST=/usr/bin/groups SCRIPTWHITELIST=/usr/bin/ldd SCRIPTWHITELIST=/usr/bin/lwp-request SCRIPTWHITELIST=/usr/sbin/adduser SCRIPTWHITELIST=/usr/sbin/prelink SCRIPTWHITELIST=/usr/bin/unhide.rb IMMUTABLE_SET=0 ALLOWHIDDENDIR="/dev/.udev" ALLOWHIDDENFILE="/dev/.initramfs" PHALANX2_DIRTEST=0 ALLOWDEVFILE="/dev/.udev/rules.d/root.rules" ALLOW_SYSLOG_REMOTE_LOGGING=0 SUSPSCAN_TEMP=/dev/shm SUSPSCAN_MAXSIZE=10240000 SUSPSCAN_THRESH=200 USE_LOCKING=0 LOCK_TIMEOUT=300 SHOW_LOCK_MSGS=1 DISABLE_UNHIDE=1 INSTALLDIR="/usr"
cronjob testscript
vi /usr/local/sbin/rkhunter.sh
#!/bin/bash RKHUNTER="/usr/bin/rkhunter -c --skip-keypress --nocolors --rwo" RKOUT="/tmp/rk.log" MAIL="technik@xinux.de" $RKHUNTER > $RKOUT if test -s $RKOUT then cat $RKOUT | mutt -s "$hostname rkhunter" $MAIL fi
crontab -e 0 0 * * 0 /usr/local/sbin/rkhunter.sh
cron.daily deaktivieren
vi /etc/default/rkhunter CRON_DAILY_RUN="no"
Warnungen
Warning: The file 'xxxx' exists on the system, but it is not present in the rkhunter.dat file. Abhilfe: rkhunter --propupd