Kā meklēt rootkitus, aizmugurējās durvis un izmantošanas iespējas, izmantojot Linux rootkit Hunter
Puiši, ja jūs regulāri lasāt vietni linux-console.net, pamanīsit, ka šis ir mūsu trešais raksts par drošības rīkiem. Iepriekšējos divos rakstos mēs esam snieguši jums visus norādījumus, kā aizsargāt Apache un Linux sistēmas no ļaunprātīgas programmatūras, DOS un DDOS uzbrukumiem, izmantojot LMD (Linux Malware Detect).
Atkal mēs esam šeit, lai ieviestu jaunu drošības rīku ar nosaukumu Rkhunter (Rootkit Hunter). Šis raksts palīdzēs jums instalēt un konfigurēt RKH (RootKit Hunter) Linux sistēmās, izmantojot avota kodu.
Kas ir Rkhunter?
Rkhunter (Rootkit Hunter) ir atvērtā koda Unix/Linux balstīts skenera rīks Linux sistēmām, kas izlaists saskaņā ar GPL un skenē jūsu sistēmu aizmugurējās durvis, rootkitus un vietējos resursus.
Tas skenē slēptos failus, nepareizās bināros iestatītās atļaujas, aizdomīgas virknes kodolā utt. Lai uzzinātu vairāk par Rkhunter un tā funkcijām, apmeklējiet vietni http://rkhunter.sourceforge.net/.
Instalējiet Rootkit Hunter Scanner Linux sistēmās
Vispirms lejupielādējiet Rkhunter rīka jaunāko stabilo versiju, dodoties uz vietni http://rkhunter.sourceforge.net/ vai izmantojiet zemāk esošo komandu Wget, lai to lejupielādētu savās sistēmās.
# cd /tmp # wget http://downloads.sourceforge.net/project/rkhunter/rkhunter/1.4.6/rkhunter-1.4.6.tar.gz
Kad esat lejupielādējis jaunāko versiju, palaidiet šīs komandas kā root lietotājam, lai to instalētu.
# tar -xvf rkhunter-1.4.6.tar.gz # cd rkhunter-1.4.6 # ./installer.sh --layout default --install
Checking system for: Rootkit Hunter installer files: found A web file download command: wget found Starting installation: Checking installation directory "/usr/local": it exists and is writable. Checking installation directories: Directory /usr/local/share/doc/rkhunter-1.4.2: creating: OK Directory /usr/local/share/man/man8: exists and is writable. Directory /etc: exists and is writable. Directory /usr/local/bin: exists and is writable. Directory /usr/local/lib64: exists and is writable. Directory /var/lib: exists and is writable. Directory /usr/local/lib64/rkhunter/scripts: creating: OK Directory /var/lib/rkhunter/db: creating: OK Directory /var/lib/rkhunter/tmp: creating: OK Directory /var/lib/rkhunter/db/i18n: creating: OK Directory /var/lib/rkhunter/db/signatures: creating: OK Installing check_modules.pl: OK Installing filehashsha.pl: OK Installing stat.pl: OK Installing readlink.sh: OK Installing backdoorports.dat: OK Installing mirrors.dat: OK Installing programs_bad.dat: OK Installing suspscan.dat: OK Installing rkhunter.8: OK Installing ACKNOWLEDGMENTS: OK Installing CHANGELOG: OK Installing FAQ: OK Installing LICENSE: OK Installing README: OK Installing language support files: OK Installing ClamAV signatures: OK Installing rkhunter: OK Installing rkhunter.conf: OK Installation complete
Palaidiet RKH atjauninātāju, lai aizpildītu datu bāzes rekvizītus, izpildot šādu komandu.
# /usr/local/bin/rkhunter --update # /usr/local/bin/rkhunter --propupd
[ Rootkit Hunter version 1.4.6 ] Checking rkhunter data files... Checking file mirrors.dat [ Updated ] Checking file programs_bad.dat [ No update ] Checking file backdoorports.dat [ No update ] Checking file suspscan.dat [ No update ] Checking file i18n/cn [ No update ] Checking file i18n/de [ No update ] Checking file i18n/en [ No update ] Checking file i18n/tr [ No update ] Checking file i18n/tr.utf8 [ No update ] Checking file i18n/zh [ No update ] Checking file i18n/zh.utf8 [ No update ] Checking file i18n/ja [ No update ] File created: searched for 177 files, found 131, missing hashes 1
Sadaļā /etc/cron.daily/ izveidojiet failu ar nosaukumu rkhunter.sh, kas pēc tam katru dienu skenē jūsu failu sistēmu un nosūta e-pasta paziņojumus uz jūsu e-pasta ID. Ar iecienītā redaktora palīdzību izveidojiet šo failu.
# vi /etc/cron.daily/rkhunter.sh
Pievienojiet tai šādas koda rindiņas un aizstājiet “YourServerNameHere” ar savu “Servera nosaukums” un “[email ” ar savu “E-pasta ID”.
#!/bin/sh ( /usr/local/bin/rkhunter --versioncheck /usr/local/bin/rkhunter --update /usr/local/bin/rkhunter --cronjob --report-warnings-only ) | /bin/mail -s 'rkhunter Daily Run (PutYourServerNameHere)' [email
Iestatiet faila izpildes atļauju.
# chmod 755 /etc/cron.daily/rkhunter.sh
Lai skenētu visu failu sistēmu, palaidiet Rkhunter kā root lietotāju.
# rkhunter --check
[ Rootkit Hunter version 1.4.6 ] Checking system commands... Performing 'strings' command checks Checking 'strings' command [ OK ] Performing 'shared libraries' checks Checking for preloading variables [ None found ] Checking for preloaded libraries [ None found ] Checking LD_LIBRARY_PATH variable [ Not found ] Performing file properties checks Checking for prerequisites [ OK ] /usr/local/bin/rkhunter [ OK ] /usr/sbin/adduser [ OK ] /usr/sbin/chkconfig [ OK ] /usr/sbin/chroot [ OK ] /usr/sbin/depmod [ OK ] /usr/sbin/fsck [ OK ] /usr/sbin/fuser [ OK ] /usr/sbin/groupadd [ OK ] /usr/sbin/groupdel [ OK ] /usr/sbin/groupmod [ OK ] /usr/sbin/grpck [ OK ] /usr/sbin/ifconfig [ OK ] /usr/sbin/ifdown [ Warning ] /usr/sbin/ifup [ Warning ] /usr/sbin/init [ OK ] /usr/sbin/insmod [ OK ] /usr/sbin/ip [ OK ] /usr/sbin/lsmod [ OK ] /usr/sbin/lsof [ OK ] /usr/sbin/modinfo [ OK ] /usr/sbin/modprobe [ OK ] /usr/sbin/nologin [ OK ] /usr/sbin/pwck [ OK ] /usr/sbin/rmmod [ OK ] /usr/sbin/route [ OK ] /usr/sbin/rsyslogd [ OK ] /usr/sbin/runlevel [ OK ] /usr/sbin/sestatus [ OK ] /usr/sbin/sshd [ OK ] /usr/sbin/sulogin [ OK ] /usr/sbin/sysctl [ OK ] /usr/sbin/tcpd [ OK ] /usr/sbin/useradd [ OK ] /usr/sbin/userdel [ OK ] /usr/sbin/usermod [ OK ] .... [Press to continue] Checking for rootkits... Performing check of known rootkit files and directories 55808 Trojan - Variant A [ Not found ] ADM Worm [ Not found ] AjaKit Rootkit [ Not found ] Adore Rootkit [ Not found ] aPa Kit [ Not found ] ..... [Press to continue] Performing additional rootkit checks Suckit Rookit additional checks [ OK ] Checking for possible rootkit files and directories [ None found ] Checking for possible rootkit strings [ None found ] .... [Press to continue] Checking the network... Performing checks on the network ports Checking for backdoor ports [ None found ] .... Performing system configuration file checks Checking for an SSH configuration file [ Found ] Checking if SSH root access is allowed [ Warning ] Checking if SSH protocol v1 is allowed [ Warning ] Checking for a running system logging daemon [ Found ] Checking for a system logging configuration file [ Found ] Checking if syslog remote logging is allowed [ Not allowed ] ... System checks summary ===================== File properties checks... Files checked: 137 Suspect files: 6 Rootkit checks... Rootkits checked : 383 Possible rootkits: 0 Applications checks... Applications checked: 5 Suspect applications: 2 The system checks took: 5 minutes and 38 seconds All results have been written to the log file: /var/log/rkhunter.log One or more warnings have been found while checking the system. Please check the log file (/var/log/rkhunter.log)
Iepriekš minētā komanda ģenerē žurnāla failu sadaļā /var/log/rkhunter.log ar Rkhunter veiktajiem pārbaudes rezultātiem.
# cat /var/log/rkhunter.log
[11:21:04] Running Rootkit Hunter version 1.4.6 on tecmint [11:21:04] [11:21:04] Info: Start date is Mon Dec 21 11:21:04 AM IST 2020 [11:21:04] [11:21:04] Checking configuration file and command-line options... [11:21:04] Info: Detected operating system is 'Linux' [11:21:04] Info: Found O/S name: Fedora release 33 (Thirty Three) [11:21:04] Info: Command line is /usr/local/bin/rkhunter --check [11:21:04] Info: Environment shell is /bin/bash; rkhunter is using bash [11:21:04] Info: Using configuration file '/etc/rkhunter.conf' [11:21:04] Info: Installation directory is '/usr/local' [11:21:04] Info: Using language 'en' [11:21:04] Info: Using '/var/lib/rkhunter/db' as the database directory [11:21:04] Info: Using '/usr/local/lib64/rkhunter/scripts' as the support script directory [11:21:04] Info: Using '/usr/local/sbin /usr/local/bin /usr/sbin /usr/bin /bin /sbin /usr/libexec /usr/local/libexec' as the command directories [11:21:04] Info: Using '/var/lib/rkhunter/tmp' as the temporary directory [11:21:04] Info: No mail-on-warning address configured [11:21:04] Info: X will be automatically detected [11:21:04] Info: Found the 'basename' command: /usr/bin/basename [11:21:04] Info: Found the 'diff' command: /usr/bin/diff [11:21:04] Info: Found the 'dirname' command: /usr/bin/dirname [11:21:04] Info: Found the 'file' command: /usr/bin/file [11:21:04] Info: Found the 'find' command: /usr/bin/find [11:21:04] Info: Found the 'ifconfig' command: /usr/sbin/ifconfig [11:21:04] Info: Found the 'ip' command: /usr/sbin/ip [11:21:04] Info: Found the 'ipcs' command: /usr/bin/ipcs [11:21:04] Info: Found the 'ldd' command: /usr/bin/ldd [11:21:04] Info: Found the 'lsattr' command: /usr/bin/lsattr ...
Lai iegūtu papildinformāciju un opcijas, lūdzu, izpildiet šo komandu.
# rkhunter --help
Ja jums patika šis raksts, kopīgošana ir īstais veids, kā pateikt paldies.