linux-Backdoor intrusion Detection Tool-chkrootkit

Rookit

Introduction: rootkit is a Linux Platform Common Trojan backdoor tool, which mainly by replacing the system files to achieve the purpose of intrusion and concealment, such Trojans than ordinary Trojan backdoor more dangerous and covert, ordinary detection tools and inspection means difficult to find this Trojan. the rootkt attack is extremely powerful and can be very damaging to the system by creating a backdoor and covert tracks through a set of tools that allow the attacker to maintain access to root at all times. permissions to log on to the system.

Rootkit There are two types of files: file-level and kernel-level

Rootkit Backdoor Detection Tool

1) Chkrootkit

Installation

Yum Install gcc gcc++ glibc-static-y

www.chkrootkit.org Download chkrootkit.tar.gz

Tar zxvf chkrootkit.tar.gz

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/7C/63/wKioL1bP3c2jvQNmAAAcnb8XHQE945.png "title=" 1.png " alt= "Wkiol1bp3c2jvqnmaaacnb8xhqe945.png"/>

CD chkrootkit-0.50/

Make sense

650) this.width=650; "src=" Http://s4.51cto.com/wyfs02/M00/7C/65/wKiom1bP3W6TTjlMAAA82D-HR9E163.png "title=" 2.png " alt= "Wkiom1bp3w6ttjlmaaa82d-hr9e163.png"/>

Cd

MV Chkrootkit-0.50//usr/local/

Use

/usr/local/chkrootkit-0.50/chkrootkit

The meaning of each parameter

- H Display Help information

- v display version information

- L Show test content

- D Debug mode to display relevant commands during the detection process

-Q Quiet mode, showing only problematic content

- x Advanced mode, show all test results

- N Skip over NFS Connected Directories

Chkrootkit Disadvantages

Chkrootkit It's easy to use, but the process uses some system commands, so when a hacker invades, you can replace some system commands, and the results become untrustworthy.

Solve this problem: Back up the system commands before the server is open to the outside.

Mkdir/usr/share/.commands

CP ' which--skip-alias awk ssh Cutecho find egrep ID head ls netstat ps strings sed uname '/usr/share/.commands

/usr/local/chkrootkit-0.50/chkrootkit-p/usr/share/.commands

650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M01/7C/63/wKioL1bP3gzjDq7mAAAyXt-u4B0078.png "title=" 3.png " alt= "Wkiol1bp3gzjdq7maaayxt-u4b0078.png"/>

Just a few orders were not detected.

linux-Backdoor intrusion Detection Tool-chkrootkit