Computer

Rootkit-detection in FreeBSD

Lars Sommer, lasg@lasg.dk, 2007-10-18
DISCLAIMER: This is a personal note made for personal usage. It might not be easy usable nor explaining.

Install these ports:
security/chkrootkit
security/rkhunter

rkhunter install options:
make options: 
WITH_LSOF=true
WITH_NMAP=true

---

chkrootkit usage:
Run sometimes with:
sudo chkrootkit -q
Or add to /etc/crontab like weekly:
10 10 * * 2 root /usr/local/sbin/chkrootkit -q  > /var/log/chkrootkit.log

---

rkhunter usage:

You should keep your rkhunter database up-to-date.
This can be done automatically by putting this line to /etc/periodic.conf:
daily_rkhunter_update_enable="YES"

Also, you can run rkhunter as a part of the daily security check by
putting this line to /etc/periodic.conf:
daily_rkhunter_check_enable="YES"

Add this "--quiet --createlogfile  --no-verbose-logging"  to:
/usr/local/etc/periodic/security/415.rkhunter
so relevant log is done

Leave a Reply

Din e-mailadresse vil ikke blive publiceret. Krævede felter er markeret med *