- SSH into your server by your normal means.
- Change to your user to root:
su - root
- Change to the source directory and download the chkrootkit files:
- Verify the MD5 to ensure the source has not been modified:
- Extract the compressed source:
tar xvzf chkrootkit.tar.gz
- Change to the directory it created:
- Compile the source tree:
- Run the chkrootkit script:
- View the results of the check, make sure there are no infected areas.
- Now change to the upper level directory.
- Remove the source .gz we downloaded earlier:
- While in SSH run the following:
- Insert the following to the new file:
./chkrootkit | mail -s "Daily chkrootkit from Servername" admin at youremail.com
- Make sure to change these values before saving the file:
-Change 'Servername' to your server
-Change 'email@example.com' to the email address you would like the report sent to
- Now save the file in vi:
- Change the file permissions of the script to make it executable:
chmod 755 /etc/cron.daily/chkrootkit.sh
- Run a test report to verify it is working correctly:
You will now receive a daily report with the results of the Rootkit Check.