Following on my previous articles, there are several good malware detection tools out there. These scanners help notify you of malware, hopefully before your clients notify you. Some of the common ones include:
chkrootkit
Linux Malware Detect (maldet)
rkhunter
Each have their own strong points, and they certainly compliment each other nicely when using them together depending on the solutions security strategy.
Maldet happens to be one of the more useful tools I use often for checking suspected compromised servers. This scanner is a very in depth tool that is great at locating backdoors within binaries and website content, as well as other malicious tools. Below is a quick introduction for installing and configuring Maldet, as well as setting up a nightly cron job.
Procedure
As a prerequisite to have Maldet’s utilize ClamAV’s engine, install ClamAV. This will significantly speed up the scan time, and it should be considered a hard requirement:
# CentOS / RedHat [root@web01 ~]# yum install clamav # Ubuntu / Debian [root@web01 ~]# apt-get install clamav
Then install it from source by:
[root@web01 ~]# wget http://www.rfxn.com/downloads/maldetect-current.tar.gz [root@web01 ~]# tar -xf maldetect-current.tar.gz [root@web01 ~]# cd maldetect-* [root@web01 ~]# ./install.sh
Now you can run the scan. You could run the scan against the / directory, but depending on how much data you have, this could take hours or days. Normally I use this tool to check my website documentroot’s as I have other tools installed to monitor other parts of my system. So assuming our website content is in /var/www, here is how you scan that directory:
[root@web01 ~]# maldet -u [root@web01 ~]# maldet --scan-all /var/www
If you would like to scan the entire server, which is good to do if you suspect you have been compromised, then you can run:
[root@web01 ~]# maldet --scan-all /
To setup a nightly cronjob, scanning your content and emailing you a report if something is found, first we need to modify the conf.maldet file as follows:
[root@web01 ~]# vi /usr/local/maldetect/conf.maldet ... email_alert=1 email_addr="[email protected]" ...
Maldet automatically installs a cronjob for this, and you can feel free to modify /etc/cron.daily/maldet to your liking. However I prefer to remove it and setup my own. Please choose whatever works best for your needs. Here is one method:
[root@web01 ~]# rm /etc/cron.daily/maldet [root@web01 ~]# crontab -e ... 32 3 * * * /usr/local/maldetect/maldet -d -u ; /usr/local/maldetect/maldet --scan-all /var/www ...
Now if maldet detects anything that flags as malware, it will send you a report via email for you to investigate.
If you are like me and want Maldet to send you daily reports via email regardless of if it found something or not, then simply setup the following cron job:
[root@web01 ~]# rm /etc/cron.daily/maldet [root@web01 ~]# crontab -e ... 32 3 * * * /usr/local/maldetect/maldet -d -u ; /usr/local/maldetect/maldet --scan-all /var/www | mail -s "Maldet Report : INSERT_HOSTNAME_HERE" [email protected] ...
The reports will look similar to the following:
Linux Malware Detect v1.5
(C) 2002-2015, R-fx Networks
(C) 2015, Ryan MacDonald
This program may be freely redistributed under the terms of the GNU GPL v2
maldet(18252): {scan} signatures loaded: 10822 (8908 MD5 / 1914 HEX / 0 USER)
maldet(18252): {scan} building file list for /var/www, this might take awhile...
maldet(18252): {scan} setting nice scheduler priorities for all operations: cpunice 19 , ionice 6
maldet(18252): {scan} file list completed in 35s, found 278654 files...
maldet(18252): {scan} found clamav binary at /usr/bin/clamscan, using clamav scanner engine...
maldet(18252): {scan} scan of /var/www (278654 files) in progress...
maldet(18252): {scan} scan completed on /var/www: files 278654, malware hits 0, cleaned hits 0, time 2355s
maldet(18252): {scan} scan report saved, to view run: maldet --report 151111-0420.12250