RKHunter是一款專業(yè)的檢測(cè)系統(tǒng)是否感染rootkit工具,RKHunter可以通過執(zhí)行一系列的腳本來確認(rèn)服務(wù)器是否已經(jīng)感染rootkit。本文主要為大家介紹RKHunter安裝及使用教程,供大家參考。
成都創(chuàng)新互聯(lián)專注于二七企業(yè)網(wǎng)站建設(shè),成都響應(yīng)式網(wǎng)站建設(shè)公司,成都做商城網(wǎng)站。二七網(wǎng)站建設(shè)公司,為二七等地區(qū)提供建站服務(wù)。全流程按需網(wǎng)站制作,專業(yè)設(shè)計(jì),全程項(xiàng)目跟蹤,成都創(chuàng)新互聯(lián)專業(yè)和態(tài)度為您提供的服務(wù)
1、安裝RKHunter(下載地址:https://sourceforge.net/projects/rkhunter/files/latest/download)
[root@server ~]# tar -zxf rkhunter-1.4.6.tar.gz #版本可能不同,命令都一樣
[root@server ~]# cd rkhunter-1.4.6
[root@server rkhunter-1.4.6]# ./installer.sh –layout default –install
注意:RKHunter的默認(rèn)安裝方式,目錄:/usr/local/bin
2、RKHunter常用參數(shù)列表
參數(shù) 含義 -c, –check 必選參數(shù),表示檢測(cè)當(dāng)前系統(tǒng) –configfile檢測(cè)示例:
[root@master rkhunter-1.4.6]# rkhunter -c[ Rootkit Hunter version 1.4.6 ]Checking system commands... Performing 'strings' command checks Checking 'strings' command [ OK ] Performing 'shared libraries' checks Checking for preloading variables [ None found ] Checking for preloaded libraries [ None found ] Checking LD_LIBRARY_PATH variable [ Not found ] Performing file properties checks Checking for prerequisites [ Warning ] /usr/local/bin/rkhunter [ OK ] /usr/sbin/adduser [ OK ] /usr/sbin/chkconfig [ OK ] /usr/sbin/chroot [ OK ] /usr/sbin/depmod [ OK ] /usr/sbin/fsck [ OK ] /usr/sbin/groupadd [ OK ] /usr/sbin/groupdel [ OK ] /usr/sbin/groupmod [ OK ] /usr/sbin/grpck [ OK ] /usr/sbin/ifconfig [ OK ] /usr/sbin/ifdown [ Warning ] /usr/sbin/ifup [ Warning ] /usr/sbin/init [ OK ] /usr/sbin/insmod [ OK ] /usr/sbin/ip [ OK ] /usr/sbin/lsmod [ OK ] /usr/sbin/lsof [ OK ] /usr/sbin/modinfo [ OK ] /usr/sbin/modprobe [ OK ] /usr/sbin/nologin [ OK ] /usr/sbin/pwck [ OK ] /usr/sbin/rmmod [ OK ] /usr/sbin/route [ OK ] /usr/sbin/rsyslogd [ OK ] /usr/sbin/runlevel [ OK ] /usr/sbin/sestatus [ OK ] /usr/sbin/sshd [ OK ] /usr/sbin/sulogin [ OK ] /usr/sbin/sysctl [ OK ] /usr/sbin/useradd [ OK ] /usr/sbin/userdel [ OK ] /usr/sbin/usermod [ OK ] /usr/sbin/vipw [ OK ] /usr/bin/awk [ OK ] /usr/bin/basename [ OK ] /usr/bin/bash [ OK ] /usr/bin/cat [ OK ] /usr/bin/chattr [ OK ] /usr/bin/chmod [ OK ] /usr/bin/chown [ OK ] /usr/bin/cp [ OK ] /usr/bin/curl [ OK ] /usr/bin/cut [ OK ] /usr/bin/date [ OK ] /usr/bin/df [ OK ] /usr/bin/diff [ OK ] /usr/bin/dirname [ OK ] /usr/bin/dmesg [ OK ] /usr/bin/du [ OK ] /usr/bin/echo [ OK ] /usr/bin/egrep [ Warning ] /usr/bin/env [ OK ] /usr/bin/fgrep [ Warning ] /usr/bin/file [ OK ] /usr/bin/find [ OK ] /usr/bin/grep [ OK ] /usr/bin/groups [ OK ] /usr/bin/head [ OK ] /usr/bin/id [ OK ] /usr/bin/ipcs [ OK ] /usr/bin/kill [ OK ] /usr/bin/last [ OK ] /usr/bin/lastlog [ OK ] /usr/bin/ldd [ Warning ] /usr/bin/less [ OK ] /usr/bin/logger [ OK ] /usr/bin/login [ OK ] /usr/bin/ls [ OK ] /usr/bin/lsattr [ OK ] /usr/bin/md5sum [ OK ] /usr/bin/mktemp [ OK ] /usr/bin/more [ OK ] /usr/bin/mount [ OK ] /usr/bin/mv [ OK ] /usr/bin/netstat [ OK ] /usr/bin/newgrp [ OK ] /usr/bin/passwd [ OK ] /usr/bin/perl [ OK ] /usr/bin/pgrep [ OK ] /usr/bin/ping [ OK ] /usr/bin/pkill [ OK ] /usr/bin/ps [ OK ] /usr/bin/pwd [ OK ] /usr/bin/readlink [ OK ] /usr/bin/rpm [ OK ] /usr/bin/runcon [ OK ] /usr/bin/sed [ OK ] /usr/bin/sh [ OK ] /usr/bin/sha1sum [ OK ] /usr/bin/sha224sum [ OK ] /usr/bin/sha256sum [ OK ] /usr/bin/sha384sum [ OK ] /usr/bin/sha512sum [ OK ] /usr/bin/size [ OK ] /usr/bin/sort [ OK ] /usr/bin/ssh [ OK ] /usr/bin/stat [ OK ] /usr/bin/strace [ OK ] /usr/bin/strings [ OK ] /usr/bin/su [ OK ] /usr/bin/sudo [ OK ] /usr/bin/tail [ OK ] /usr/bin/telnet [ OK ] /usr/bin/test [ OK ] /usr/bin/top [ OK ] /usr/bin/touch [ OK ] /usr/bin/tr [ OK ] /usr/bin/uname [ OK ] /usr/bin/uniq [ OK ] /usr/bin/users [ OK ] /usr/bin/vmstat [ OK ] /usr/bin/w [ OK ] /usr/bin/watch [ OK ] /usr/bin/wc [ OK ] /usr/bin/wget [ OK ] /usr/bin/whatis [ OK ] /usr/bin/whereis [ OK ] /usr/bin/which [ OK ] /usr/bin/who [ OK ] /usr/bin/whoami [ OK ] /usr/bin/numfmt [ OK ] /usr/bin/kmod [ OK ] /usr/bin/systemctl [ OK ] /usr/bin/gawk [ OK ] /usr/lib/systemd/systemd [ OK ] /etc/rkhunter.conf [ OK ][Press解讀:每項(xiàng)檢測(cè)結(jié)果都高亮顯示,綠色表示正常,紅色表示需要引起關(guān)注,上面的檢測(cè)需要與用戶交互輸入“回車”,可以使用–sk選項(xiàng)使其自動(dòng)檢測(cè):
[root@master rkhunter-1.4.6]# rkhunter –check –skip-keypress
3、定時(shí)檢測(cè)
Linux終端使用rkhunter來檢測(cè),最大的好處在于每項(xiàng)的檢測(cè)結(jié)果都有不同的顏色顯示,如果是綠色的表示沒有問題,如果是紅色的,那就要引起關(guān)注了。另外,在上面執(zhí)行檢測(cè)的過程中,在每個(gè)部分檢測(cè)完成后,需要以Enter鍵來繼續(xù)。如果要讓程序自動(dòng)運(yùn)行,可以執(zhí)行如下命令:
30 09 * * * root /usr/local/bin/rkhunter –check –cronjob
解讀:rkhunter檢測(cè)程序就會(huì)在每天的9:30分運(yùn)行一次。
4、安全更新
測(cè)試是否存在漏洞,執(zhí)行以下命令:
$ env x='() { :;}; echo vulnerable’ bash -c “echo this is a test”
vulnerable
this is a test
如果顯示如上,那么,很遺憾,必須立即打上安全補(bǔ)丁修復(fù),
臨時(shí)解決辦法為:
yum -y update bash
升級(jí)bash后,執(zhí)行測(cè)試:
$ env x='() { :;}; echo vulnerable’ bash -c “echo this is a test”
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x’
this is a test
如果顯示如上,表示已經(jīng)修補(bǔ)了漏洞。