Localhost scans with rkhunter and chkrootkit

rosv · 02-16-2011, 05:55 AM

Hi,

Let's say you have a host with some kind of locally installed root kit detector/scanner.

If someone managed to get root access to that box. Wouldn't the first thing to do, before installing a root kit, be to remove any kind root kit detector?

salasi · 02-16-2011, 06:01 AM

A good point and an argument for not permanently installing that kind of security program, but coming along with some media with a 'known good' copy which includes, eg, a .rpm and using that instead.

rosv · 02-16-2011, 06:25 AM

I guess one way to handle this is to use centralized root kit scanning.

But on the other hand, the centralized scanning service must be able to connect to the host in some way. So if someone got root, she would probably disable that remote possibility anyways.

Back to square one....

unSpawn · 02-16-2011, 08:23 PM

In addition to what's said already:

Quote:

Originally Posted by rosv

Let's say you have a host with some kind of locally installed root kit detector/scanner. If someone managed to get root access to that box. Wouldn't the first thing to do, before installing a root kit, be to remove any kind root kit detector?

Chkrootkit and Rootkit Hunter are post-incident diagnostic tools: they may complement but do not replace system hardening. So anyone who relies on these tools alone for "security" (or asks questions based on that) is doing things wrong.

Quote:

Originally Posted by rosv

the centralized scanning service must be able to connect to the host in some way

Check out how for instance Samhain does things.