By Joining the mailing list you will be notified of site updates.

Audience: System Administrators
Last Updated: 3/21/2011 8:23:12 PM
Original Creation Date: 11/25/2006 12:57:42 PM
**All times are EST**

This article is a howto on installing and running rkhunter. If you administer any Linux/UNIX boxes that touch the internet, you should read this!

---

What is a rootkit?

A rootkit is a program that runs on a *nix-based OSes, that allows a remote user to execute certain code or commands. There are many different types of rootkits. Some mount themselves among legit daemons and "hide" themselves often reporting results, output, or data to a remote server. Most rootkits I've seen aren't destructive. They are malicious in nature because they use your server as zombie or bot. If you somehow encounter a really bad rootkit, it could allow a hacker remote access (ssh or telnet) with full root privledges. This is another reason to keep all your packages up2date.

What does rkhunter do?

Rkhunter is much like a virus scanner for a Windows system. It has definitions to help identify rootkits and reports them. Just like anything, rkhunter isn't 100%, but it weeds out the majority of rootkits. Upon running rkhunter, various system files, conf files, and bin directories are examined. The results are cross-referenced against the results of infected systems (from the defintions) and the results are compiled. This is where *nix systems really shine. While your OS may vary, and how it's compiled or configured, the file system and configuration is basically the same. This allows porgrams like rkhunter to provide results with a fairly small window for error or false positive.

Installing rkhunter

Just like all the other packages for *nix, you'll have to download it's tar file from their website. Sometimes I mirror packages on this site, but because this one changes often I'm not going to do that. You can find the latest version from the rkhunter websites (rootkit.nl). Obviously you have root privledges to install this. Here we go:

[root@roswell root]# wget www.orlandotechworks.com/rkhunter/rkhunter-1.2.8.tar.tar
--13:17:10-- http://www.orlandotechworks.com/rkhunter/rkhunter-1.2.8.tar.tar
 => `rkhunter-1.2.8.tar.tar'
Resolving www.orlandotechworks.com... 74.52.121.148
Connecting to www.orlandotechworks.com|74.52.121.148|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 126,314 (123K) [application/x-tar]
100%[================================================================================>] 126,314 259.19K/s
13:17:10 (258.38 KB/s) - `rkhunter-1.2.8.tar.tar' saved [126314/126314]
[root@roswell root]# tar -xzvf rkhunter*.tar
./rkhunter/files/
./rkhunter/files/CHANGELOG
./rkhunter/files/LICENSE
./rkhunter/files/README
./rkhunter/files/WISHLIST
./rkhunter/files/backdoorports.dat
./rkhunter/files/check_modules.pl
./rkhunter/files/check_port.pl
./rkhunter/files/defaulthashes.dat
./rkhunter/files/filehashmd5.pl
./rkhunter/files/filehashsha1.pl
./rkhunter/files/mirrors.dat
./rkhunter/files/os.dat
./rkhunter/files/rkhunter
./rkhunter/files/rkhunter.conf
./rkhunter/files/rkhunter.spec
./rkhunter/files/showfiles.pl
./rkhunter/files/md5blacklist.dat
./rkhunter/files/tools/
./rkhunter/files/tools/update_server.sh
./rkhunter/files/tools/update_client.sh
./rkhunter/files/tools/README
./rkhunter/files/check_update.sh
./rkhunter/files/programs_bad.dat
./rkhunter/files/contrib/
./rkhunter/files/contrib/run_rkhunter.sh
./rkhunter/files/contrib/README.txt
./rkhunter/files/testing/
./rkhunter/files/testing/stringscanner.sh
./rkhunter/files/testing/rootkitinfo.txt
./rkhunter/files/testing/rkhunter.conf
./rkhunter/files/development/
./rkhunter/files/development/createfilehashes.pl
./rkhunter/files/development/createhashes.sh
./rkhunter/files/development/rpmhashes.sh
./rkhunter/files/development/rpmprelinkhashes.sh
./rkhunter/files/development/osinformation.sh
./rkhunter/files/development/rkhunter.8
./rkhunter/files/development/createhashesall.sh
./rkhunter/files/development/search_dead_sysmlinks.sh
./rkhunter/files/programs_good.dat
./rkhunter/installer.sh
[root@roswell root]# cd rkhunter
[root@roswell rkhunter]# ls
files installer.sh
[root@roswell rkhunter]# ./installer.sh
Rootkit Hunter installer 1.2.4 (Copyright 2003-2005, Michael Boelen)
---------------
Starting installation/update
Checking /usr/local... OK
Checking file retrieval tools... /usr/bin/wget
Checking installation directories...
- Checking /usr/local/rkhunter...Created
- Checking /usr/local/rkhunter/etc...Created
- Checking /usr/local/rkhunter/bin...Created
- Checking /usr/local/rkhunter/lib/rkhunter/db...Created
- Checking /usr/local/rkhunter/lib/rkhunter/docs...Created
- Checking /usr/local/rkhunter/lib/rkhunter/scripts...Created
- Checking /usr/local/rkhunter/lib/rkhunter/tmp...Created
- Checking /usr/local/etc...Exists
- Checking /usr/local/bin...Exists
Checking system settings...
 - Perl... OK
Installing files...
Installing Perl module checker... OK
Installing Database updater... OK
Installing Portscanner... OK
Installing MD5 Digest generator... OK
Installing SHA1 Digest generator... OK
Installing Directory viewer... OK
Installing Database Backdoor ports... OK
Installing Database Update mirrors... OK
Installing Database Operating Systems... OK
Installing Database Program versions... OK
Installing Database Program versions... OK
Installing Database Default file hashes... OK
Installing Database MD5 blacklisted files... OK
Installing Changelog... OK
Installing Readme and FAQ... OK
Installing Wishlist and TODO... OK
Installing RK Hunter configuration file... OK
Installing RK Hunter binary... OK
Configuration updated with installation path (/usr/local/rkhunter)
Installation ready.
See /usr/local/rkhunter/lib/rkhunter/docs for more information. Run 'rkhunter' (/usr/local/bin/rkhunter)

Running rkhunter

Well that's it! As you can see I downloaded the package using wget, unpacked it, and installed it using a shell script. Now that it's installed let's run it! The results below are from a non-production RHEL3 box.

[root@roswell rkhunter]# rkhunter -c
Rootkit Hunter 1.2.8 is running
Determining OS... Unknown
Warning: This operating system is not fully supported!
Warning: Cannot find md5_not_known
All MD5 checks will be skipped!
Checking binaries
* Selftests
 Strings (command) [ OK ]
* System tools
 Skipped!
Check rootkits
* Default files and directories
 Rootkit '55808 Trojan - Variant A'... [ OK ]
 ADM Worm... [ OK ]
 Rootkit 'AjaKit'... [ OK ]
 Rootkit 'aPa Kit'... [ OK ]
 Rootkit 'Apache Worm'... [ OK ]
 Rootkit 'Ambient (ark) Rootkit'... [ OK ]
 Rootkit 'Balaur Rootkit'... [ OK ]
 Rootkit 'BeastKit'... [ OK ]
 Rootkit 'beX2'... [ OK ]
 Rootkit 'BOBKit'... [ OK ]
 Rootkit 'CiNIK Worm (Slapper.B variant)'... [ OK ]
 Rootkit 'Danny-Boy's Abuse Kit'... [ OK ]
 Rootkit 'Devil RootKit'... [ OK ]
 Rootkit 'Dica'... [ OK ]
 Rootkit 'Dreams Rootkit'... [ OK ]
 Rootkit 'Duarawkz'... [ OK ]
 Rootkit 'Flea Linux Rootkit'... [ OK ]
 Rootkit 'FreeBSD Rootkit'... [ OK ]
 Rootkit 'Fuck`it Rootkit'... [ OK ]
 Rootkit 'GasKit'... [ OK ]
 Rootkit 'Heroin LKM'... [ OK ]
 Rootkit 'HjC Kit'... [ OK ]
 Rootkit 'ignoKit'... [ OK ]
 Rootkit 'ImperalsS-FBRK'... [ OK ]
 Rootkit 'Irix Rootkit'... [ OK ]
 Rootkit 'Kitko'... [ OK ]
 Rootkit 'Knark'... [ OK ]
 Rootkit 'Li0n Worm'... [ OK ]
 Rootkit 'Lockit / LJK2'... [ OK ]
 Rootkit 'MRK'... [ OK ]
 Rootkit 'Ni0 Rootkit'... [ OK ]
 Rootkit 'RootKit for SunOS / NSDAP'... [ OK ]
 Rootkit 'Optic Kit (Tux)'... [ OK ]
 Rootkit 'Oz Rootkit'... [ OK ]
 Rootkit 'Portacelo'... [ OK ]
 Rootkit 'R3dstorm Toolkit'... [ OK ]
 Rootkit 'RH-Sharpe's rootkit'... [ OK ]
 Rootkit 'RSHA's rootkit'... [ OK ]
 Sebek LKM [ OK ]
 Rootkit 'Scalper Worm'... [ OK ]
 Rootkit 'Shutdown'... [ OK ]
 Rootkit 'SHV4'... [ OK ]
 Rootkit 'SHV5'... [ OK ]
 Rootkit 'Sin Rootkit'... [ OK ]
 Rootkit 'Slapper'... [ OK ]
 Rootkit 'Sneakin Rootkit'... [ OK ]
 Rootkit 'Suckit Rootkit'... [ OK ]
 Rootkit 'SunOS Rootkit'... [ OK ]
 Rootkit 'Superkit'... [ OK ]
 Rootkit 'TBD (Telnet BackDoor)'... [ OK ]
 Rootkit 'TeLeKiT'... [ OK ]
 Rootkit 'T0rn Rootkit'... [ OK ]
 Rootkit 'Trojanit Kit'... [ OK ]
 Rootkit 'Tuxtendo'... [ OK ]
 Rootkit 'URK'... [ OK ]
 Rootkit 'VcKit'... [ OK ]
 Rootkit 'Volc Rootkit'... [ OK ]
 Rootkit 'X-Org SunOS Rootkit'... [ OK ]
 Rootkit 'zaRwT.KiT Rootkit'... [ OK ]
* Suspicious files and malware
 Scanning for known rootkit strings [ OK ]
 Scanning for known rootkit files [ OK ]
 Testing running processes... [ OK ]
 Miscellaneous Login backdoors [ OK ]
 Miscellaneous directories [ OK ]
 Software related files [ OK ]
 Sniffer logs [ OK ]
* Trojan specific characteristics
 shv4
 Checking /etc/rc.d/rc.sysinit
 Test 1 [ Clean ]
 Test 2 [ Clean ]
 Test 3 [ Clean ]
 Checking /etc/inetd.conf [ Not found ]
 Checking /etc/xinetd.conf [ Clean ]
* Suspicious file properties
 chmod properties
 Checking /bin/ps [ Clean ]
 Checking /bin/ls [ Clean ]
 Checking /usr/bin/w [ Clean ]
 Checking /usr/bin/who [ Clean ]
 Checking /bin/netstat [ Clean ]
 Checking /bin/login [ Clean ]
 Script replacements
 Checking /bin/ps [ Clean ]
 Checking /bin/ls [ Clean ]
 Checking /usr/bin/w [ Clean ]
 Checking /usr/bin/who [ Clean ]
 Checking /bin/netstat [ Clean ]
 Checking /bin/login [ Clean ]
* OS dependant tests
 Linux
 Checking loaded kernel modules... [ OK ]
 Checking files attributes [ OK ]
 Checking LKM module path [ OK ]
Networking
* Check: frequently used backdoors
 Port 2001: Scalper Rootkit [ OK ]
 Port 2006: CB Rootkit [ OK ]
 Port 2128: MRK [ OK ]
 Port 14856: Optic Kit (Tux) [ OK ]
 Port 47107: T0rn Rootkit [ OK ]
 Port 60922: zaRwT.KiT [ OK ]
* Interfaces
 Scanning for promiscuous interfaces [ OK ]
System checks
* Allround tests
 Checking hostname... Found. Hostname is roswell
 Checking for passwordless user accounts... OK
 Checking for differences in user accounts... OK. No changes.
 Checking for differences in user groups... OK. No changes.
 Checking boot.local/rc.local file...
 - /etc/rc.local [ OK ]
 - /etc/rc.d/rc.local [ OK ]
 - /usr/local/etc/rc.local [ Not found ]
 - /usr/local/etc/rc.d/rc.local [ Not found ]
 - /etc/conf.d/local.start [ Not found ]
 - /etc/init.d/boot.local [ Not found ]
 Checking rc.d files...
 Processing........................................
 ........................................
 ........................................
 ........................................
 ........................................
 ........................................
 ........................................
 ........................................
 ........................................
 ........................................
 ........................................
 ...................................
 Result rc.d files check [ OK ]
 Checking history files
 Bourne Shell [ OK ]
* Filesystem checks
 Checking /dev for suspicious files... [ OK ]
 Scanning for hidden files... [ OK ]
Application advisories
* Application scan
 Checking Apache2 modules ... [ Not found ]
 Checking Apache configuration ... [ OK ]
* Application version scan
 - GnuPG 1.2.1 [ Old or patched version ]
 - Apache 2.0.46 [ Old or patched version ]
 - Bind DNS 9.2.4 [ OK ]
 - OpenSSL 0.9.7a [ Old or patched version ]
 - PHP 4.3.2 [ Old or patched version ]
 - Procmail MTA 3.22 [ OK ]
 - OpenSSH 3.6.1p2 [ Old or patched version ]
Security advisories
* Check: Groups and Accounts
 Searching for /etc/passwd... [ Found ]
 Checking users with UID '0' (root)... [ OK ]
* Check: SSH
 Searching for sshd_config...
 Found /etc/ssh/sshd_config
 Checking for allowed root login... Watch out Root login possible. Possible risk!
 info:
 Hint: See logfile for more information about this issue
 Checking for allowed protocols... [ OK (Only SSH2 allowed) ]
* Check: Events and Logging
 Search for syslog configuration... [ OK ]
 Checking for running syslog slave... [ OK ]
 Checking for logging to remote system... [ OK (no remote logging) ]
 
 

Results and Conclusion

Upon running the program, the results are compiled and displayed. They will be somewhat arbitrary because of different OSes, configurations and kernel builds. However, the action of detecting root kits and backdoors still works. As I mentioned above, this is a MUST if you adminster and *nix boxes that touch the internet. Rootkits are often the worst type of compromise possible. Most of them are designed to infect your OS, and do what it's designed to do, with minimal detection. Don't make the mistake of waiting to harden and audit your OS! You won't enjoy the aftermath because you didn't take the few hours to setup your precautionary methods before green lighting your production machines.

TCP vs. UDP

Extreme Networks: Downloading new software image

Juniper SRX save config to USB drive

Juniper SRX logout sessions

Extreme Networks Syslog Configuration

Command line drive mapping

Data Security vs. Data Protection