Contents
Why is rkhunter an effective tool to find rootkits?
Most antivirus programs use heuristics to some extent, which means that they look for things that look like viruses, even if it doesn’t specifically recognize every virus. rkhunter has no ability to look for rootkit-like things; it is path-based meaning it can only look for rootkits it already knows about.
What is rkhunter dat?
For rkhunter to perform file property checks, it must first 485 have a database file (‘rkhunter.dat’) containing the property 486 values for each file. It can then compare each files current 487 values against those stored in the database.
What are rootkits used for?
A rootkit allows someone to maintain command and control over a computer without the computer user/owner knowing about it. Once a rootkit has been installed, the controller of the rootkit has the ability to remotely execute files and change system configurations on the host machine.
Where can I find rkhunter on CentOS 7?
Having first seen this with Ubuntu 18.04, we will now look at it and a little more detail using rkhunter on CentOS 7. In CentOS 7 rkhunter is found in the EPEL repository, we must make sure that this is available to use first: The install then is straight forward using yum and we update in the same way as in Ubuntu
How does rkhunter check for root access in SSH?
Of course, adding a new user will trigger the warning again but will also update the reference files, /var/lib/rkhunter/passwd and /var/lib/rkhunter/group. Each check will update the references. By default the CentOS install does not check root access in SSH. We should enable this by editong /etc/rkhunter.conf. Look for the line:
Can a CentOS install check for root access?
By default the CentOS install does not check root access in SSH. We should enable this by editong /etc/rkhunter.conf. Look for the line: The file /etc/ssh/sshd_config can be configured with: Running the rkhunter check now will report SSH root login as secured. The execution of rkhunter is enabled with cron by default.