chkrootkit 入侵监测系统－－－－－原创

[root@localhost voilet]# wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz
--19:15:31--  ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz
           => `chkrootkit.tar.gz'
正在解析主机 ftp.pangeia.com.br... 200.155.17.114
Connecting to ftp.pangeia.com.br|200.155.17.114|:21... 已连接。
正在以 anonymous 登录 ... 登录成功！
==> SYST ... 完成。    ==> PWD ... 完成。
==> TYPE I ... 完成。  ==> CWD /pub/seg/pac ... 完成。
==> SIZE chkrootkit.tar.gz ... 39421
==> PASV ... 完成。    ==> RETR chkrootkit.tar.gz ... 完成。
长度：39421 (38K)

100%[===============================================================>] 39,421      21.0K/s   in 1.8s

19:15:41 (21.0 KB/s) - `chkrootkit.tar.gz' saved [39421]

[root@localhost voilet]# cd chkrootkit*
[root@localhost chkrootkit-0.49]# make sense
gcc -DHAVE_LASTLOG_H -o chklastlog chklastlog.c
gcc -DHAVE_LASTLOG_H -o chkwtmp chkwtmp.c
chkwtmp.c: In function ‘main’:
chkwtmp.c:95: 警告：隐式声明与内建函数 ‘exit’ 不兼容
gcc -DHAVE_LASTLOG_H   -D_FILE_OFFSET_BITS=64 -o ifpromisc ifpromisc.c
gcc  -o chkproc chkproc.c
gcc  -o chkdirs chkdirs.c
gcc  -o check_wtmpx check_wtmpx.c
gcc -static  -o strings-static strings.c
gcc  -o chkutmp chkutmp.c
[root@localhost chkrootkit-0.49]# cd ..
[root@localhost voilet]# cp -r chkrootkit-* /usr/local/
777/            etc/            lib/            mrtg-2/         share/          src/
BerkeleyDB.4.7/ games/          libexec/        samp/           sinff/          ssl/
bin/            include/        man/            sbin/           snmp/           webserver/
[root@localhost voilet]# cp -r chkrootkit-* /usr/local/chkrootkit
[root@localhost voilet]# rm -rf chkrootkit*
[root@localhost voilet]# cd /usr/local/chkrootkit/
[root@localhost chkrootkit]# ./chkrootkit |grep INFECTED                如未出现INFECTED则表面OK，这里需要等会时间有点点长，可以去喝杯咖啡
[root@localhost ~]# chmod 700 chkrootkit                                加个脚本可执行的权限
[root@localhost ~]# mv chkrootkit /etc/cron.daily/                        将脚本移动到每天自动运行的目录中
[root@localhost ~]# mkdir /root/commands/                                建立暂时存放命令备份的目录
[root@localhost ~]# cp `which --skip-alias awk cut echo egrep find head id ls netstat ps strings sed uname` /root/commands/                                                        备份系统命令到建立好的目录
[root@localhost ~]# /usr/local/chkrootkit/chkrootkit -p /root/commands|grep INFECTED        用备份的命令运行chkrootkit

tar: 从成员名中删除开头的“/”
/root/commands/
/root/commands/awk
/root/commands/sed
/root/commands/ls
/root/commands/netstat
/root/commands/strings
/root/commands/id
/root/commands/echo
/root/commands/cut
/root/commands/ps
/root/commands/head
/root/commands/egrep
/root/commands/find
/root/commands/uname

[root@localhost ~]# gzip /root/commands.tar                                 将打包的文件压缩
[root@localhost ~]# ls
anaconda-ks.cfg  commands  commands.tar.gz  Desktop  install.log  install.log.syslog