(Fedora: Lesson 16)

{ Installing rkhunter }

Section 0. Background Information

What is rkhunter?
- rkhunter (Rootkit Hunter) is a Unix/Linux-based tool that scans for rootkits, backdoors and possible local exploits.
- It does this by comparing SHA-1 hashes of core operating system files with known good files against its' database.
- It searches for default directories (of rootkits), wrong permissions, hidden files, suspicious strings in kernel modules, and conducts additional tests for Linux and FreeBSD.
Pre-Requisite Lab
- Fedora: Lesson 1: Installing Fedora 14
Legal Disclaimer
- As a condition of your use of this Web site, you warrant to computersecuritystudent.com that you will not use this Web site for any purpose that is unlawful or that is prohibited by these terms, conditions, and notices.
- In accordance with UCC § 2-316, this product is provided with "no warranties, either expressed or implied." The information contained is provided "as-is", with "no guarantee of merchantability."
- In addition, this is a teaching website that does not condone malicious behavior of any kind.
- Your are on notice, that continuing and/or using this lab outside your "own" test environment is considered malicious and is against the law.
- © 2012 No content replication of any kind is allowed without express written permission.

Section 1: Configure Fedora14 Virtual Machine Settings

Open Your VMware Player
- Instructions:
  1. On Your Host Computer, Go To
  2. Start --> All Program --> VMWare --> VMWare Player
Edit BackTrack Virtual Machine Settings
- Instructions:
  1. Highlight fedora14
  2. Click Edit virtual machine settings
Edit Network Adapter
- Instructions:
  1. Highlight Network Adapter
  2. Select Bridged
  3. Click on the OK Button.

Section 2: Login to your Fedora14 server.

Start Fedora14 VM Instance
- Instructions:
  1. Start Up VMWare Player
  2. Select Fedora14
  3. Play virtual machine
Login to Fedora14
- Instructions:
  1. Login: student
  2. Password: <whatever you set it to>.

Section 3: Open Console Terminal and Retrieve IP Address

Start a Terminal Console
- Instructions:
  1. Applications --> Terminal
Switch user to root
- Instructions:
  1. su - root
  2. <Whatever you set the root password to>
Get IP Address
- Instructions:
  1. ifconfig -a
- Note(fyi):
  - As indicated below, my IP address is 192.168.1.106.
  - Please record your IP address.
  - Issue the below commands if you do not have an IP Address:
    1. dhclient -v
    2. ifconfig -a

Section 4: Installing rkhunter

Search for rkhunter
- Instructions:
  1. yum list rkhunter
Install rkhunter
- Instructions:
  1. yum install rkhunter
Answer "y"
- Instructions:
  1. Is this ok [y/N]: y
View installation results
- Note(FYI):
  1. You "should" see a Complete message following the installation.

Section 5: Running rkhunter

Run rkhunter
- Instructions:
  1. rkhunter --check
Command Check
- Note(FYI):
  - rkhunter has just performed a file property check on all the core system commands.
- Instructions:
  1. Press Enter
Root Kit Check
- Note(FYI):
  - rkhunter checked all the previous unix/linux commands for root kits.
- Instructions:
  1. Press Enter
Network, Local Host, Password and SSH Check
- Note(FYI):
  - rkhunter just checked both the external and internet network services.
  - rkhunter checked the password file for other users that also had root UID privileges of 0.
  - rkhunter check ssh for various items including if root was allowed to log in remotely.
- Instructions:
  1. Press Enter
System checks summary
- Note(FYI):
  1. Once complete rkhunter will display a summary for File properties checks, Rootkit checks, and Applications checks.

Section 6: Create rkhunter cronjob

Search for mailx
- Instructions:
  1. yum list mailx
- Note(FYI):
  - We will use mailx to sent chkrootkit email reports.
Install mailx
- Instructions:
  1. yum install mailx
  2. Is this ok [y/N]: y
Verify mailx installation results
- Notes:
  1. Verify the installation report finished with a "Complete!" message.
Setting up cron
- Instructions:
  1. su - root, if you are not already root.
  2. crontab -e
    - crontab is a unix/linux scheduler that allows each user, daemon, or system process run a task at a specified time.
    - In this case, we are going to set up a scheduled task for user root.
Copy Cronjob Entry
- Instructions:
  1. Highlight and Copy the below text.
  2. ```
  #
  #.---------------- minute (0 - 59)
  #|  .------------- hour (0 - 23)
  #|  |  .---------- day of month (1 - 31)
  #|  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
  #|  |  |  |  .---- day of week (0 - 7) (Sunday=0 or 7)  OR sun,mon,tue,wed,thu,fri,sat
  #|  |  |  |  |
  #*  *  *  *  *  command to be executed
  00 08 * * * /usr/bin/rkhunter --check --nocolors --skip-keypress 2>&1 | /bin/mailx -s "rkhunter scan" YourEmail
```
- Note(FYI):
  1. rkhunter --check --nocolors --skip-keypress
    - --check, run rkhunter like you did from command line.
    - --nocolors, do not use colors.
    - --skip-keypress, does not require a human's interactive input.
  2. 2>&1
    - 2 is standard error in unix/linux.
    - 1 is standard input.
    - >&, means redirect standard error into standard input.
  3. |
    - rkhunter's output is piped (i.e., or sent to) mailx.
  4. mailx -s "rkhunter scan" YourEmail
    - mailx, allows you to send and receive email. (Read Manpage)
    - -s "rkhunter", is the subject of the email.
    - YourEmail, is your actual email address.
Setting up cron
- Instructions:
  1. Press "i" to get into INSERT MODE.
  2. Select Edit --> Paste from the menu
  3. Press the <Esc> key to get out of INSERT MODE
  4. Type :wq to save and exit the vi editor.

Section 7: Proof of Lab

Proof of Lab
- Instructions
  1. su - root, if you are not already root.
  2. grep "Rootkit Hunter" /var/log/secure | tail -2
  3. cat /var/spool/cron/root
  4. date
  5. echo "Your Name"
    - Replace the string "Your Name" with your actual name.
    - e.g., echo "John Gray"
- Proof of Lab Instructions
  1. Press both the <Ctrl> and <Alt> keys at the same time.
  2. Do a <PrtScn>
  3. Paste into a word document
  4. Upload to Moodle