轉(zhuǎn)載：http://blog.chinaunix.net/uid-24103417-id-4391068.html
rkhunter --check --skip-keypress
中文名叫”Rootkit獵手”, 可以發(fā)現(xiàn)大約58個(gè)已知的rootkits和一些嗅探器和后門(mén)程序. 它通過(guò)執(zhí)行一系列的測(cè)試腳本來(lái)確認(rèn)你的機(jī)器是否已經(jīng)感染rootkits. 比如檢查rootkits使用的基本文件, 可執(zhí)行二進(jìn)制文件的錯(cuò)誤文件權(quán)限, 檢測(cè)內(nèi)核模塊等等. Rootkit Hunter由Michael Boelen開(kāi)發(fā), 是開(kāi)源(GPL)軟件.目前最新版本1.4.2
官方現(xiàn)在地址：http://sourceforge.net/projects/rkhunter/
一.rkhunter安裝
下載的是最新版本的1.4.2
wget -S http://downloads.sourceforge.net/project/rkhunter/rkhunter/1.4.2/rkhunter-1.4.2.tar.gz?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Frkhunter%2F&ts=1397456404&use_mirror=jaist
現(xiàn)在完成后只需要解壓，運(yùn)行./install.sh即可
tar zxvf rkhunter-1.4.2.tar.gz
cd rkhunter-1.4.2
./installer.sh --install #一般沒(méi)有錯(cuò)誤很快會(huì)完成
點(diǎn)擊(此處)折疊或打開(kāi)
Checking system for:
Rootkit Hunter installer files: found
A web file download command: wget found
Starting update:
Checking installation directory "/usr/local": it exists and is writable.
Checking installation directories:
Directory /usr/local/share/doc/rkhunter-1.4.2: exists and is writable.
Directory /usr/local/share/man/man8: exists and is writable.
Directory /etc: exists and is writable.
Directory /usr/local/bin: exists and is writable.
Directory /usr/local/lib64: exists and is writable.
Directory /var/lib: exists and is writable.
Directory /usr/local/lib64/rkhunter/scripts: exists and is writable.
Directory /var/lib/rkhunter/db: exists and is writable.
Directory /var/lib/rkhunter/tmp: exists and is writable.
Directory /var/lib/rkhunter/db/i18n: exists and is writable.
Directory /var/lib/rkhunter/db/signatures: exists and is writable.
Installing check_modules.pl: OK
Installing filehashsha.pl: OK
Installing stat.pl: OK
Installing readlink.sh: OK
Installing backdoorports.dat: OK
Installing mirrors.dat: OK
Installing programs_bad.dat: OK
Installing suspscan.dat: OK
Installing rkhunter.8: OK
Installing ACKNOWLEDGMENTS: OK
Installing CHANGELOG: OK
Installing FAQ: OK
Installing LICENSE: OK
Installing README: OK
Installing language support files: OK
Installing ClamAV signatures: OK
Installing rkhunter: OK
Installing rkhunter.conf in no-clobber mode: OK
PLEASE NOTE: inspect for update changes in "/etc/rkhunter.conf.6525",
and apply to either "/etc/rkhunter.conf" or your local configuration
file before running Rootkit Hunter.
Update complete
二.檢測(cè)系統(tǒng)是否感染后門(mén)或惡意軟件
安裝完成后運(yùn)行rkhunter會(huì)出現(xiàn)幫助信息
1.為基本系統(tǒng)程序建立校對(duì)樣本，建議系統(tǒng)安裝完成后就建立。
執(zhí)行命令：
rkhunter --propupd
ls /var/lib/rkhunter/db/rkhunter.dat #樣本文件位置
2.查殺后門(mén)執(zhí)行命令：
rkhunter --check
只顯示報(bào)警信息可以運(yùn)行
rkhunter -c --rwo （report-warnings-only，只顯示報(bào)警信息）
掃描完成后會(huì)生成一份日志存放在/var/log/rkhunter.log
3.在線(xiàn)升級(jí)rkhunter
rkhunter是通過(guò)一個(gè)含有rootkit名字的數(shù)據(jù)庫(kù)來(lái)檢測(cè)系統(tǒng)的rootkits漏洞, 所以經(jīng)常更新該數(shù)據(jù)庫(kù)非常重要, 你可以通過(guò)下面命令來(lái)更新該數(shù)據(jù)庫(kù):
執(zhí)行命令：
rkhunter --update
4.檢測(cè)最新版本
讓 rkhunter 保持在最新的版本邻邮；
執(zhí)行命令：
rkhunter --versioncheck
