Click here for "Safe Air Conditioner Repair and Proper Freon Recovery".(Japanese Version)

OracleLinux9.2 ; Tripwire , Chkrootkit , Logwatch , Disk Usage Check Script

Tripwire

1.Download and installation

2.Passphrase setting

Set site passphrase and local passphrase

3.Tripwire Configuration

Configuration File Edit

Create a Tripwire configuration file (cryptographically signed version)

Delete Tripwire configuration file (text version)

Policy File Settings

Contents of twpolmake.pl

⑤Policy File Optimizations

Create policy file (cryptographically signed version) based on optimized policy file

Create database and check operation

Create test files

Check Tripwire operation

Delete test files

Tripwire Scheduled Scripts

Contents of tripwire.sh

⑨Tripwire Autorun Script Execution Settings

Reference: Script for reporting results by e-mail

Confirmation that the results of the tripwire execution are notified to the specified e-mail address

Chkrootkit

①Download and install chkrootkit

Create /root/bin directory and move chkrootkit command to that directory

Check chkrootkit.

Checking `chsh'... INFECTED
If the above display appears, it is probably a false positive.

Create chkrootkit periodic execution script and change permissions
Create chkrootkit execution script in a directory where it is automatically executed daily

Scheduled Script Contents

Add execution permission to chkrootkit execution script

Backup commands used by chkrootkit

If the commands used by chkrootkit are tampered with, rootkit will not be detected.
Back up these commands.
If necessary, run chkrootkit with the backed up command

Run chkrootkit on the copied command

If nothing is displayed, no problem.

Compresses backed up commands

Send chkrootkit use command (compressed version) to root by e-mail

Download and save chkrootkit_cmd.tar.gz file to Windows

Delete commands on the backed up server

Logwatch

①Install

②Edit configuration file

Output Logwatch reports

It will appear as follows

Test to see if the report arrives at the address you set. Check if you receive a log report email like the one above.

Introduce disk usage check script

3.1 Script Creation

Contents of disk_capacity_check.sh

3.2 Execution Confirmation

①Check current usage rates

It appears as follows

②Create a dummy file to achieve at least 80% utilization(In the example, it is called "dummyfile" and is about 20G)

③check again

④Run check scripts

You will receive an email to the email address you have set up, stating something like "Disk usage alert: 92 %".

⑤Delete "dummyfile"

⑥Periodic Execution Setting

Copied title and URL