Ok I know the question sounds strange but I need help installing rkhunter the accurate way and do I need to follow all the steps in this article https://help.ubuntu.com/community/RKhunter?
1 Answer
The package rkhunter
is in the repos, so just
sudo apt-get install rkhunter
So is chkrootkit
sudo apt-get install chkrootkit
"rkhunter vs chkrootkit?" comparison from wikipedia
rkhunter (Rootkit Hunter) is a Unix-based tool that scans for rootkits, backdoors and possible local exploits. It does this by comparing SHA-1 hashes of important files with known good ones in online databases, searching for default directories (of rootkits), wrong permissions, hidden files, suspicious strings in kernel modules, and special tests for Linux and FreeBSD.
The tool has been written in Bourne shell, to allow for portability. It can run on almost all UNIX-derived systems.
chkrootkit (Check Rootkit) is a common Unix-based program intended to help system administrators check their system for known rootkits. It is a shell script using common UNIX/Linux tools like the strings and grep commands to search core system programs for signatures and for comparing a traversal of the /proc filesystem with the output of the ps (process status) command to look for discrepancies.
It can be used from a "rescue disc" (typically a Live CD) or it can optionally use an alternative directory from which to run all of its own commands. These techniques allow chkrootkit to trust the commands upon which it depends a bit more.
There are inherent limitations to the reliability of any program that attempts to detect compromises (such as rootkits and computer viruses). Newer rootkits may specifically attempt to detect and compromise copies of the chkrootkit programs or take other measures to evade detection by them.
-
Wait what about this article help.ubuntu.com/community/RKhunter do I need to do all that stuff in the instructions.– user491354Feb 12, 2016 at 8:56
-
Those are configuration options, do the ones you need, you can use
sudo rkhunter --propupd
to run it manually, when you want or addAPT_AUTOGEN="yes"
to/etc/default/rkhunter
and it will auto run after software updater, the rest is just version check and hiding warnings, you don't need to do theses steps if the warnings don't bother you. Feb 12, 2016 at 9:03 -
So that's optional.– user491354Feb 12, 2016 at 9:05
-
Yes the bottom ha#lf of the page is just hiding the warnings, it does not matter if you hide them or not, your choice. Feb 12, 2016 at 9:07