I'm not really a Linux noob (I know how to recompile the kernel and other stuff) but I don't really know a *whole* lot about security as I only use it as a desktop system (unless I'm using one of my old PCs as a game server - but they're not important and I don't really care if THEY get compromised - and I haven't run a game server in a while anyways).

I recently learned about Linux rootkits and I was wondering if I need to worry about them - I'm not running a server or anything, and my router has firewall capabilities built in. Do I still need to worry about them anyways? Are there any protocols I should disable just in case?

Also, I'm using Slackware 10.2 - is there any tool already packaged with Slack to scan for rootkits?

You don't have to worry about rootkits in particular anymore than you'd worry about any other aspect of security. A rootkit is something that's installed after someone hacks into your box (its not something that spreads around the net infecting machines like a virus). It is a good idea to have a rootkit scanner run every night as it can often pickup the tell-tale signs of a rootkit, even though for one to be installed your machine would already have to have been compromised in some way. chkrootkit is a good one and I'm sure slackware has packages for it.

And if you keep up with updates and stick to open-source software or slackware packages then you should be fine.

Give this one a spin.

http://www.rootkit.nl/projects/rootkit_hunter.html

And if you keep up with updates
Make that "If you have a hardened box and if you keep up with updates".


and stick to open-source software or slackware packages then you should be fine.
Closed source, OSS and even Slackware packages can be compromised: always check GPG keys.



Give this one a spin.
Both Chkrootkit and Rootkit Hunter are good tools. Only thing is they need to be used in combination with a file integrity checker and both tools should be installed before the box is allowed on the 'net. Chkrootkit and Rootkit Hunter will only check for default strings and search in default locations for default files. Place files in another location and they won't be found. Chkrootkit still tries stubbornly to rely on the ancient ifpromisc instead of the better capabilities of /sbin/ip. Other accompanying binaries can also be circumvented. Take for instance Adore-NG. Change 1 digit in the source code, and Chkrootkit's chkproc will not be able to find it. A file integrity checker like Aide or Samhain can be configured to scan a whole system for changes, which gives you a clearer picture of changes on the system. Some distro's have package managers that also will check checksums, but these won't pick up changes like introducing new files.