(Fedora: Lesson 20)

{ Installing chkrootkit }

• What is chkrootkit? 
  • chkrootkit (Check Rootkit) is a common Unix-based program intended to help system administrators check their system for known rootkits.
  
  
  • It is a shell script using common UNIX/Linux tools like the strings and grep commands to search core system programs for signatures and for comparing a traversal of the /proc filesystem with the output of the ps (process status) command to look for discrepancies.
  
  
• Pre-Requisite Lab
  • Fedora: Lesson 1: Installing Fedora 14
  
  
• Legal Disclaimer
  • As a condition of your use of this Web site, you warrant to computersecuritystudent.com that you will not use this Web site for any purpose that is unlawful or that is prohibited by these terms, conditions, and notices.
  • In accordance with UCC § 2-316, this product is provided with "no warranties, either expressed or implied." The information contained is provided "as-is", with "no guarantee of merchantability."
  • In addition, this is a teaching website that does not condone malicious behavior of any kind.
  • Your are on notice, that continuing and/or using this lab outside your "own" test environment is considered malicious and is against the law.
  • © 2012 No content replication of any kind is allowed without express written permission.

1. Open Your VMware Player
   • Instructions:
     1. On Your Host Computer, Go To
     2. Start --> All Program --> VMWare --> VMWare Player

    

2. Edit BackTrack Virtual Machine Settings
   • Instructions:
     1. Highlight fedora14
     2. Click Edit virtual machine settings
   • 

    

3. Edit Network Adapter
   • Instructions:
     1. Highlight Network Adapter
     2. Select Bridged
     3. Click on the OK Button.
   • 

1. Start Fedora14 VM Instance
   • Instructions:
     1. Start Up VMWare Player
     2. Select Fedora14
     3. Play virtual machine
   • 

    

2. Login to Fedora14
   • Instructions:
     1. Login: student
     2. Password: <whatever you set it to>.
   • 

1. Start a Terminal Console
   • Instructions:
     1. Applications --> Terminal
   • 

    

2. Switch user to root
   • Instructions:
     1. su - root
     2. <Whatever you set the root password to>
   • 

    

3. Get IP Address
   • Instructions:
     1. ifconfig -a
   • Notes:
     • As indicated below, my IP address is 192.168.1.106.
     • Please record your IP address.
   • 

    

1. Update YUM's package index
   • Instructions
     1. yum list updates
   • Notes
     • This YUM command updates the repo list file located in the following patch: 
       • /var/cache/yum/i*/*/updates/updateinfo.xml
   • 

    

2. See Repo List File
   • Instructions
     1. ls -l /var/cache/yum/i*/*/updates/updateinfo.xml
   • Notes
     • If any updates have been made to the updateinfo.xml, both the byte size and timestamp will change
   • 

    

3. Search for chkrootkit
   • Instructions:
     1. yum list | grep chkrootkit
   • 

    

4. Install chkrootkit
   • Instructions:
     1. yum install chkrootkit
     2. Is this ok [y/N]: y
   • 

    

5. View installation results
   • Notes:
     1. You "should" see a "Complete!" message following the installation.
   • 

1. Run chkrootkit's help menu
   • Instructions:
     1. chkrootkit -help
   • Notes:
     • Your can use the "-h" or the "-help" flag to print the help menu.
   • 

    

2. List chkrootkit's checks
   • Instructions:
     1. chkrootkit -l
   • Notes:
     • Use the "-l" flag to show which programs will be checked by chkrootkit.
   • 

    

3. Run chkrootkit in expert verbose mode
   • Instructions:
     1. chkrootkit -x
   • Notes:
     • The "-x" flag runs chkrootkit in verbose mode.
   • 

    

4. View chkrootkit results
   • Notes:
     • Notice the "not infected" messages.
   • 

1. Search for mailx
   • Instructions:
     1. yum list mailx
   • Notes:
     • We will use mailx to sent chkrootkit email reports.
   • 

    

2. Install mailx
   • Instructions:
     1. yum install mailx
     2. Is this ok [y/N]: y
   • 

    

3. Verify mailx installation results
   • Notes:
     1. Verify the installation report finished with a "Complete!" message.
   • 

    

4. Download chkrootkit-report.pl
   • Instructions:
     1. cd /usr/bin/
     2. wget http://www.computersecuritystudent.com/UNIX/FEDORA/lesson20/chkrootkit-report.pl
     3. ls -l chkrootkit-report.pl
     4. chmod 755 chkrootkit-report.pl
   • 

    

5. Setting up cron
   • Instructions:
     1. su - root, if you are not already root.
     2. crontab -e
        • crontab is a unix/linux scheduler that allows each user, daemon, or system process run a task at a specified time.
        • In this case, we are going to set up a scheduled task for user root.
   • 

    

6. Copy Cronjob Entry
   • Instructions:
     1. Highlight and Copy the below text.

        • #CHKROOTKIT
          05 08 * * * /usr/bin/chkrootkit-report.pl

7. Setting up cron
   • Instructions:
     1. Press <Shift> and "g"
        • This will place the cursor on the last line.
     2. Press "o"
        • This will insert a line below the current line and it will place you into insert mode.
     3. Select Edit --> Paste from the menu
     4. Press the <Esc> key to get out of INSERT MODE
     5. Type :wq to save and exit the vi editor. 
   • 

    

1. Proof of Lab
   • Instructions:
     1. /usr/bin/chkrootkit-report.pl
     2. ls -l /var/log/chkrootkit.log
     3. date
     4. echo "Your Name"
        • Replace the string "Your Name" with your actual name.
        • e.g., echo "John Gray"
   • Proof of Lab Instructions
     1. Press both the <Ctrl> and <Alt> keys at the same time.
     2. Do a <PrtScn>
     3. Paste into a word document
     4. Upload to Moodle
   •