CentOS 7 chkrootkit

Using CentOS 7 chkrootkit

The standard repositories for CentOS do not include a package for chkrootkit as they do for Ubuntu. However, this is not really an issue as the installation from source is not a difficult task. To use CentOS 7 chkrootkit, first, we make sure that we have the packages needed to compile from source. The group Development Tools is a good target for this, but we will also add wget and glibc-static.

$ sudo yum groups install -y "Development Tools"

$ sudo yum install -y wget glibc-static

We can now download the source from the software author. The website is http://www.chkrootkit.org. You can check on the latest version from the site and retrieve the link to download it. As of 2017 the current version is 0.52 for us to use CentOS 7 chkrootkit. To download the current version:

$ wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz

Now you can proceed to expand the archive:

$ tar -xzf chkrootkit.tar.gz

We can then move into the directory and compile the required files. The main program is a shell script, this script, though, calls the compliled binaries.

$ cd chkrootkit-0.52/

To compile the code we uase make. There is only one make target in the Makefile. The target is called sense, so we can amusingly call:

$ make sense

We now should copy the directory to a sensible location:

$ cd ; sudo mv chkrootkit-0.52/ /usr/local/ 

$ ln -s /usr/local/chkrootkit-0.52/ /usr/local/chkrootkit

The last command creates a link /usr/local/chkrootkit that points to the current version directory /usr/local/chkrootkit-0.52/. When a new version is developed we can link to the new directory. The link gives us a consistent location to use that is independent to the verion of chkrootkit.

The chkrootkit script calls the compiled binaries using a relative path. We should run the command from the directory which we can acheive by grouping commands:

$ sudo bash -c 'cd /usr/local/chkrootkit && ./chkrootkit -q'

Running Cronjobs

Most of the time we will by running chkrootkit and most other malware detectors as a cron job. If we have compiled chkrootkit we will need to define our own cron task. To run the task daily we can create a script in /etc/cron.daily

$ sudo vim /etc/cron.daily/chkrootkit 

#!/bin/sh
cd /usr/local/chkrootkit
./chkrootkit -q | mail -s "CHKROOTKIT daily run" root

$ chmod +x /etc/cron.daily/chkrootkit

We can leave this to run with cron and check the root user’s mail daily. To test execution we can execute as the root user:

$ sudo /etc/cron.daily/chkrootkit

To check the mail has been recieved we can open a root shell and read mail:

$ sudo -i
# mail