Rootkit Finders.

Luke_C · 07-25-2006, 08:16 AM

Hi All,
I have used rootkit hunter and its a bit old now is there any newer version of the software that does the same jobs at all please.

Luke

prozac · 07-25-2006, 08:18 AM

chkrootkit is what i use.

Luke_C · 07-25-2006, 08:23 AM

Nice one dude any links for us please

Just found it seems to be old is this updated at all.

~=gr3p=~ · 07-25-2006, 08:30 AM

rkhunter is what i use.

unSpawn · 07-25-2006, 09:22 AM

I have used rootkit hunter
What version? From where?

and its a bit old now
Why? What's the reason for saying this? If you have gripes, comments, suggestions, patches (very welcome, but use version 1.2.8) or even undetected rootkits get on the mailinglist.

is there any newer version of the software
The next release of RKH will be available in a few weeks.

Please note Chkrootkit and Rootkit Hunter share some overlap, but also address finding problems differently. It does not hurt using both. That said tools like these have their scope which is not system-wide which means you must not rely solely on those tools. Yes, I'm talking system hardening and auditing. Check out the LQ Security References thread for more.

unSpawn · 07-25-2006, 09:31 AM

BTW, please finish your other thread "Perl in Redhat 8 Hacked Me Thinks" properly.

~=gr3p=~ · 07-25-2006, 09:50 AM

oh so dear Unspawn is the developer of rkhunter

nice tool thanks.

unSpawn · 07-25-2006, 10:10 AM

oh so dear Unspawn is the developer of rkhunter nice tool thanks.
No, Michael is.

~=gr3p=~ · 07-25-2006, 10:20 AM

oh thank you Michael

unSpawn · 07-25-2006, 02:33 PM

Forgot there's another tool on the block: Zeppoo. Haven't tested it yet and it's for 2.6.x only for now. D/L at http://sourceforge.net/projects/zeppoo . Any verbose testing reports welcome.

unSpawn · 07-26-2006, 08:53 AM

Forgot there's another tool on the block: OSSEC Rootcheck. Haven't tested it thoroughly yet. D/L at http://www.ossec.net/en/rootcheck.html .

Luke_C · 07-27-2006, 03:39 AM

Cheers Unspawn.... I give you a virtual pint

Matir · 07-27-2006, 12:27 PM

I need to check those two out. I've been predominantly relying on chkrootkit and rkhunter for my system security testing.

unSpawn · 08-01-2006, 09:43 AM

@~=gr3p=~: oh thank you Michael
ROTFL. By now it's me and the RKH team ;-p

@Luke_C: I give you a virtual pint
Thanks.

@Matir: I've been predominantly relying on chkrootkit and rkhunter
While they're good at what they do you're correct (as goes with any tool) it's better not to rely on one or two of the same "class". Next to basic host hardening (prevention always is better), if there's one thing I would recommend it's running one of GRSecurity/LIDS/RSBAC/SELinux. Two things. If there's two things I would recommend it's running that and one of Aide (passive), Samhain (active) or even tripwire. No, three things. If there's three things I would recommend it's running that and one of Logwatch, Swatch, Tenshi or Logcheck.

Matir · 08-01-2006, 11:02 AM

Quote:

Originally Posted by unSpawn

@Matir: I've been predominantly relying on chkrootkit and rkhunter
While they're good at what they do you're correct (as goes with any tool) it's better not to rely on one or two of the same "class". Next to basic host hardening (prevention always is better), if there's one thing I would recommend it's running one of GRSecurity/LIDS/RSBAC/SELinux. Two things. If there's two things I would recommend it's running that and one of Aide (passive), Samhain (active) or even tripwire. No, three things. If there's three things I would recommend it's running that and one of Logwatch, Swatch, Tenshi or Logcheck.

I do run Logwatch. SELinux gave me too many headaches, never tried any of the others.