Linux : Sécuriser avec Rkhunter

‎ ‎

Installation

sudo apt-get install rkhunter

Fichier de configuration /etc/default/rkhunter

# Defaults for rkhunter automatic tasks
# sourced by /etc/cron.*/rkhunter and /etc/apt/apt.conf.d/90rkhunter
#
# This is a POSIX shell fragment
#

# Set this to yes to enable rkhunter daily runs
# (default: false)
CRON_DAILY_RUN="yes"

# Set this to yes to enable rkhunter weekly database updates
# (default: false)
CRON_DB_UPDATE="yes"

# Set this to yes to enable reports of weekly database updates
# (default: false)
DB_UPDATE_EMAIL="false"

# Set this to the email address where reports and run output should be sent
# (default: root)
REPORT_EMAIL="webmaster@yakakliker.org"

# Set this to yes to enable automatic database updates
# (default: false)
APT_AUTOGEN="yes"

# Nicenesses range from -20 (most favorable scheduling) to 19 (least favorable)
# (default: 0)
NICE="0"

# Should daily check be run when running on battery
# powermgmt-base is required to detect if running on battery or on AC power
# (default: false)
RUN_CHECK_ON_BATTERY="false"

Quelques commandes

Mise à jour manuelles des "signatures"

sudo rkhunter --propupd

Analyse manuelle du système

sudo rkhunter -c

Lien

https://www.it-connect.fr/securisez-vos-systemes-linux-avec-rkhunter/?utm_content=cmp-true

https://www.remipoignon.fr/securiser-son-serveur-linux/

https://rkhunter.sourceforge.net/

Rkhunter : Warning: The command '/usr/bin/lwp-request' has been replaced by a script: /usr/bin/lwp-request: Perl script text executable

Rkhunter : Invalid WEB CMD configuration option: Relative pathname: "/bin/false"