ComputerSecurityStudent (CSS) [Login] [Join Now]




|UNIX >> Fedora >> Current Page |Views: 7173

(Fedora: Lesson 16)

{ Installing rkhunter }


Section 0. Background Information
  • What is rkhunter? 
    • rkhunter (Rootkit Hunter) is a Unix/Linux-based tool that scans for rootkits, backdoors and possible local exploits.

    • It does this by comparing SHA-1 hashes of core operating system files with known good files against its' database.

    • It searches for default directories (of rootkits), wrong permissions, hidden files, suspicious strings in kernel modules, and conducts additional tests for Linux and FreeBSD.

  • Pre-Requisite Lab
  • Legal Disclaimer
    • As a condition of your use of this Web site, you warrant to computersecuritystudent.com that you will not use this Web site for any purpose that is unlawful or that is prohibited by these terms, conditions, and notices.
    • In accordance with UCC § 2-316, this product is provided with "no warranties, either expressed or implied." The information contained is provided "as-is", with "no guarantee of merchantability."
    • In addition, this is a teaching website that does not condone malicious behavior of any kind.
    • Your are on notice, that continuing and/or using this lab outside your "own" test environment is considered malicious and is against the law.
    • © 2012 No content replication of any kind is allowed without express written permission.

 

Section 1: Configure Fedora14 Virtual Machine Settings
  1. Open Your VMware Player
    • Instructions:
      1. On Your Host Computer, Go To
      2. Start --> All Program --> VMWare --> VMWare Player

     

  2. Edit BackTrack Virtual Machine Settings
    • Instructions:
      1. Highlight fedora14
      2. Click Edit virtual machine settings

     

  3. Edit Network Adapter
    • Instructions:
      1. Highlight Network Adapter
      2. Select Bridged
      3. Click on the OK Button.

 

Section 2: Login to your Fedora14 server.
  1. Start Fedora14 VM Instance
    • Instructions:
      1. Start Up VMWare Player
      2. Select Fedora14
      3. Play virtual machine

     

  2. Login to Fedora14
    • Instructions:
      1. Login: student
      2. Password: <whatever you set it to>.

 

Section 3: Open Console Terminal and Retrieve IP Address
  1. Start a Terminal Console
    • Instructions:
      1. Applications --> Terminal

     

  2. Switch user to root
    • Instructions:
      1. su - root
      2. <Whatever you set the root password to>

     

  3. Get IP Address
    • Instructions:
      1. ifconfig -a
    • Note(fyi):
      • As indicated below, my IP address is 192.168.1.106.
      • Please record your IP address.
      • Issue the below commands if you do not have an IP Address:
        1. dhclient -v
        2. ifconfig -a

     

Section 4: Installing rkhunter
  1. Search for rkhunter
    • Instructions:
      1. yum list rkhunter

     

  2. Install rkhunter
    • Instructions:
      1. yum install rkhunter

     

  3. Answer "y"
    • Instructions:
      1. Is this ok [y/N]: y

     

  4. View installation results
    • Note(FYI):
      1. You "should" see a Complete message following the installation.

 

Section 5: Running rkhunter
  1. Run rkhunter
    • Instructions:
      1. rkhunter --check

     

  2. Command Check
    • Note(FYI):
      • rkhunter has just performed a file property check on all the core system commands.
    • Instructions:
      1. Press Enter

     

  3. Root Kit Check
    • Note(FYI):
      • rkhunter checked all the previous unix/linux commands for root kits.
    • Instructions:
      1. Press Enter

     

  4. Network, Local Host, Password and SSH Check
    • Note(FYI):
      • rkhunter just checked both the external and internet network services.
      • rkhunter checked the password file for other users that also had root UID privileges of 0.
      • rkhunter check ssh for various items including if root was allowed to log in remotely.
    • Instructions:
      1. Press Enter

     

  5. System checks summary
    • Note(FYI):
      1. Once complete rkhunter will display a summary for File properties checks, Rootkit checks, and Applications checks.

 

Section 6: Create rkhunter cronjob
  1. Search for mailx
    • Instructions:
      1. yum list mailx
    • Note(FYI):
      • We will use mailx to sent chkrootkit email reports.

     

  2. Install mailx
    • Instructions:
      1. yum install mailx
      2. Is this ok [y/N]: y

     

  3. Verify mailx installation results
    • Notes:
      1. Verify the installation report finished with a "Complete!" message.

     

  4. Setting up cron
    • Instructions:
      1. su - root, if you are not already root.
      2. crontab -e
        • crontab is a unix/linux scheduler that allows each user, daemon, or system process run a task at a specified time.
        • In this case, we are going to set up a scheduled task for user root.

     

  5. Copy Cronjob Entry
    • Instructions:
      1. Highlight and Copy the below text.
      2. #
        #.---------------- minute (0 - 59)
        #|  .------------- hour (0 - 23)
        #|  |  .---------- day of month (1 - 31)
        #|  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
        #|  |  |  |  .---- day of week (0 - 7) (Sunday=0 or 7)  OR sun,mon,tue,wed,thu,fri,sat
        #|  |  |  |  |
        #*  *  *  *  *  command to be executed
        00 08 * * * /usr/bin/rkhunter --check --nocolors --skip-keypress 2>&1 | /bin/mailx -s "rkhunter scan" YourEmail
    • Note(FYI):
      1. rkhunter --check --nocolors --skip-keypress
        • --check, run rkhunter like you did from command line.
        • --nocolors, do not use colors.
        • --skip-keypress, does not require a human's interactive input.
      2. 2>&1
        • 2 is standard error in unix/linux.
        • 1 is standard input.
        • >&, means redirect standard error into standard input.
      3. |
        • rkhunter's output is piped (i.e., or sent to) mailx.
      4. mailx -s "rkhunter scan" YourEmail
        • mailx, allows you to send and receive email. (Read Manpage)
        • -s "rkhunter", is the subject of the email.
        • YourEmail, is your actual email address.

       

  6. Setting up cron
    • Instructions:
      1. Press "i" to get into INSERT MODE.
      2. Select Edit --> Paste from the menu
      3. Press the <Esc> key to get out of INSERT MODE
      4. Type :wq to save and exit the vi editor. 

     

Section 7: Proof of Lab
  1. Proof of Lab
    • Instructions
      1. su - root, if you are not already root.
      2. grep "Rootkit Hunter" /var/log/secure | tail -2
      3. cat /var/spool/cron/root
      4. date
      5. echo "Your Name"
        • Replace the string "Your Name" with your actual name.
        • e.g., echo "John Gray"
    • Proof of Lab Instructions
      1. Press both the <Ctrl> and <Alt> keys at the same time.
      2. Do a <PrtScn>
      3. Paste into a word document
      4. Upload to Moodle
    •  

 



Help ComputerSecurityStudent
pay for continued research,
resources & bandwidth