OracleLinux10.0 : Tripwire , Chkrootkit , DNS update Script , Logwatch , Disk Usage Check Script

Contents

Tripwire
Chkrootkit
Logwatch
DNS Update Script
Introduce disk usage check script
- 1. Script Creation
- 2. Execution Confirmation

Tripwire

1.Download and installation

I couldn't find it in the epel10 repository, so I forced myself to use it for epel9.

# cd /usr/local/src
# wget https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/t/tripwire-2.4.3.7-16.el9.x86_64.rpm
# rpm -Uvh tripwire-2.4.3.7-16.el9.x86_64.rpm

# cd /usr/local/src

# wget https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/t/tripwire-2.4.3.7-16.el9.x86_64.rpm

# rpm -Uvh tripwire-2.4.3.7-16.el9.x86_64.rpm

2.Passphrase setting

Set site passphrase and local passphrase

# tripwire-setup-keyfiles

1	# tripwire-setup-keyfiles

----------------------------------------------
The Tripwire site and local passphrases are used to sign a variety of
files, such as the configuration, policy, and database files.
Passphrases should be at least 8 characters in length and contain both
letters and numbers.
See the Tripwire manual for more information.
----------------------------------------------
Creating key files...
(When selecting a passphrase, keep in mind that good passphrases typically
have upper and lower case letters, digits and punctuation marks, and are
at least 8 characters in length.)
Enter the site keyfile passphrase: ←Enter any "Site Passphrase"
Verify the site keyfile passphrase: ←Enter "Site Passphrase" again
Generating key (this may take several minutes)...Key generation complete.
(When selecting a passphrase, keep in mind that good passphrases typically
have upper and lower case letters, digits and punctuation marks, and are
at least 8 characters in length.)
Enter the local keyfile passphrase: ←Enter any "local passphrase"
Verify the local keyfile passphrase: ←Enter "Local Passphrase" again
Generating key (this may take several minutes)...Key generation complete.
----------------------------------------------
Signing configuration file...
Please enter your site passphrase: ←Enter "Site Passphrase"
Wrote configuration file: /etc/tripwire/tw.cfg
A clear-text version of the Tripwire configuration file:
/etc/tripwire/twcfg.txt
has been preserved for your inspection. It is recommended that you
move this file to a secure location and/or encrypt it in place (using a
tool such as GPG, for example) after you have examined it.
----------------------------------------------
Signing policy file...
Please enter your site passphrase: ←Enter "Site Passphrase"
Wrote policy file: /etc/tripwire/tw.pol
A clear-text version of the Tripwire policy file:
/etc/tripwire/twpol.txt
～omission～
default values from the current configuration file are used.

----------------------------------------------

The Tripwire site and local passphrases are used to sign a variety of

files, such as the configuration, policy, and database files.

Passphrases should be at least 8 characters in length and contain both

letters and numbers.

See the Tripwire manual for more information.

----------------------------------------------

Creating key files...

(When selecting a passphrase, keep in mind that good passphrases typically

have upper and lower case letters, digits and punctuation marks, and are

at least 8 characters in length.)

Enter the site keyfile passphrase: ←Enter any "Site Passphrase"

Verify the site keyfile passphrase: ←Enter "Site Passphrase" again

Generating key (this may take several minutes)...Key generation complete.

(When selecting a passphrase, keep in mind that good passphrases typically

have upper and lower case letters, digits and punctuation marks, and are

at least 8 characters in length.)

Enter the local keyfile passphrase: ←Enter any "local passphrase"

Verify the local keyfile passphrase: ←Enter "Local Passphrase" again

Generating key (this may take several minutes)...Key generation complete.

----------------------------------------------

Signing configuration file...

Please enter your site passphrase: ←Enter "Site Passphrase"

Wrote configuration file: /etc/tripwire/tw.cfg

A clear-text version of the Tripwire configuration file:

/etc/tripwire/twcfg.txt

has been preserved for your inspection. It is recommended that you

move this file to a secure location and/or encrypt it in place (using a

tool such as GPG, for example) after you have examined it.

----------------------------------------------

Signing policy file...

Please enter your site passphrase: ←Enter "Site Passphrase"

Wrote policy file: /etc/tripwire/tw.pol

A clear-text version of the Tripwire policy file:

/etc/tripwire/twpol.txt

～omission～

default values from the current configuration file are used.

3.Tripwire Configuration

①Configuration File Edit

# vi /etc/tripwire/twcfg.txt

Line 9
Change to "LOOSEDIRECTORYCHECKING =true"
 
Line 12 : change
REPORTLEVEL =4

# vi /etc/tripwire/twcfg.txt

Line 9

Change to "LOOSEDIRECTORYCHECKING =true"

Line 12 : change

REPORTLEVEL =4

②Create a Tripwire configuration file (cryptographically signed version)

# twadmin -m F -c /etc/tripwire/tw.cfg -S /etc/tripwire/site.key /etc/tripwire/twcfg.txt
Please enter your site passphrase: ←Enter site passphrase
Wrote configuration file: /etc/tripwire/tw.cfg

# twadmin -m F -c /etc/tripwire/tw.cfg -S /etc/tripwire/site.key /etc/tripwire/twcfg.txt

Please enter your site passphrase: ←Enter site passphrase

Wrote configuration file: /etc/tripwire/tw.cfg

③Delete Tripwire configuration file (text version)

# rm -f /etc/tripwire/twcfg.txt

1	# rm -f /etc/tripwire/twcfg.txt

④Policy File Settings

# cd /etc/tripwire/
# vi twpolmake.pl

1 2	# cd /etc/tripwire/ # vi twpolmake.pl

Contents of twpolmake.pl

#!/usr/bin/perl
#
$POLFILE=$ARGV[0];

open(POL,"$POLFILE") or die "open error: $POLFILE" ;
my($myhost,$thost) ;
my($sharp,$tpath,$cond) ;
my($INRULE) = 0 ;

while (<POL>) {
chomp;
if (($thost) = /^HOSTNAME\s*=\s*(.*)\s*;/) {
$myhost = `hostname` ; chomp($myhost) ;
if ($thost ne $myhost) {
$_="HOSTNAME=\"$myhost\";" ;
}
}
elsif ( /^{/ ) {
$INRULE=1 ;
}
elsif ( /^}/ ) {
$INRULE=0 ;
}
elsif ($INRULE == 1 and ($sharp,$tpath,$cond) = /^(\s*\#?\s*)(\/\S+)\b(\s+->\s+.+)$/) {
$ret = ($sharp =~ s/\#//g) ;
if ($tpath eq '/sbin/e2fsadm' ) {
$cond =~ s/;\s+(tune2fs.*)$/; \#$1/ ;
}
if (! -s $tpath) {
$_ = "$sharp#$tpath$cond" if ($ret == 0) ;
}
else {
$_ = "$sharp$tpath$cond" ;
}
}
print "$_\n" ;
}
close(POL) ;

#!/usr/bin/perl

$POLFILE=$ARGV[0];

open(POL,"$POLFILE") or die "open error: $POLFILE" ;

my($myhost,$thost) ;

my($sharp,$tpath,$cond) ;

my($INRULE) = 0 ;

while (<POL>) {

chomp;

if (($thost) = /^HOSTNAME\s*=\s*(.*)\s*;/) {

$myhost = `hostname` ; chomp($myhost) ;

if ($thost ne $myhost) {

$_="HOSTNAME=\"$myhost\";" ;

}

elsif ( /^{/ ) {

$INRULE=1 ;

}

elsif ( /^}/ ) {

$INRULE=0 ;

}

elsif ($INRULE == 1 and ($sharp,$tpath,$cond) = /^(\s*\#?\s*)(\/\S+)\b(\s+->\s+.+)$/) {

$ret = ($sharp =~ s/\#//g) ;

if ($tpath eq '/sbin/e2fsadm' ) {

$cond =~ s/;\s+(tune2fs.*)$/; \#$1/ ;

}

if (! -s $tpath) {

$_ = "$sharp#$tpath$cond" if ($ret == 0) ;

}

else {

$_ = "$sharp$tpath$cond" ;

}

print "$_\n" ;

}

close(POL) ;

⑤Policy File Optimizations

# perl /etc/tripwire/twpolmake.pl /etc/tripwire/twpol.txt > /etc/tripwire/twpol.txt.new

1	# perl /etc/tripwire/twpolmake.pl /etc/tripwire/twpol.txt > /etc/tripwire/twpol.txt.new

⑥Create policy file (cryptographically signed version) based on optimized policy file

# twadmin -m P -c /etc/tripwire/tw.cfg -p /etc/tripwire/tw.pol -S /etc/tripwire/site.key /etc/tripwire/twpol.txt.new
Please enter your site passphrase: ←Enter site passphrase
Wrote policy file: /etc/tripwire/tw.pol

# twadmin -m P -c /etc/tripwire/tw.cfg -p /etc/tripwire/tw.pol -S /etc/tripwire/site.key /etc/tripwire/twpol.txt.new

Please enter your site passphrase: ←Enter site passphrase

Wrote policy file: /etc/tripwire/tw.pol

⑦Create database and check operation

# tripwire -m i -s -c /etc/tripwire/tw.cfg
Please enter your local passphrase: ←Enter local passphrase

1 2	# tripwire -m i -s -c /etc/tripwire/tw.cfg Please enter your local passphrase: ←Enter local passphrase

Create test files

# echo test > /root/test.txt

1	# echo test > /root/test.txt

Check Tripwire operation

# tripwire -m c -s -c /etc/tripwire/tw.cfg

OK if it appears as follows
Open Source Tripwire(R) 2.4.3.7 Integrity Check Report

Report generated by:          root
Report created on:            Sat 02 Aug 2025 09:32:51 AM JST
Database last updated on:     Never

===============================================================================
Report Summary:
===============================================================================

Host name:                    Lepard
Host IP address:              192.168.11.83
Host ID:                      None
Policy file used:             /etc/tripwire/tw.pol
Configuration file used:      /etc/tripwire/tw.cfg
Database file used:           /var/lib/tripwire/Lepard.twd
Command line used:            tripwire -m c -s -c /etc/tripwire/tw.cfg

===============================================================================
Rule Summary:
===============================================================================

-------------------------------------------------------------------------------
  Section: Unix File System
-------------------------------------------------------------------------------

  Rule Name                       Severity Level    Added    Removed  Modified
  ---------                       --------------    -----    -------  --------
  User binaries                   66                0        0        0
  Tripwire Binaries               100               0        0        0
  Libraries                       66                0        0        0
  Operating System Utilities      100               0        0        0
  File System and Disk Administraton Programs
                                  100               0        0        0
  Kernel Administration Programs  100               0        0        0
  Networking Programs             100               0        0        0
  System Administration Programs  100               0        0        0
  Hardware and Device Control Programs
                                  100               0        0        0
  System Information Programs     100               0        0        0
  (/sbin/runlevel)
  Application Information Programs
                                  100               0        0        0
  (/sbin/rtmon)
  Critical Utility Sym-Links      100               0        0        0
  Shell Binaries                  100               0        0        0
  Critical system boot files      100               0        0        0
* Tripwire Data Files             100               1        0        0
  System boot changes             100               0        0        0
  OS executables and libraries    100               0        0        0
  Security Control                100               0        0        0
  Login Scripts                   100               0        0        0
  Critical configuration files    100               0        0        0
* Root config files               100               1        0        1
  Invariant Directories           66                0        0        0
  Temporary directories           33                0        0        0
  Critical devices                100               0        0        0

Total objects scanned:  147676
Total violations found:  3

===============================================================================
Object Summary:
===============================================================================

-------------------------------------------------------------------------------
# Section: Unix File System
-------------------------------------------------------------------------------

-------------------------------------------------------------------------------
Rule Name: Tripwire Data Files (/var/lib/tripwire)
Severity Level: 100
-------------------------------------------------------------------------------

Added:
"/var/lib/tripwire/Lepard.twd"

-------------------------------------------------------------------------------
Rule Name: Root config files (/root)
Severity Level: 100
-------------------------------------------------------------------------------

Added:
"/root/test.txt"

Modified:
"/root"

===============================================================================
Error Report:
===============================================================================

No Errors

-------------------------------------------------------------------------------
*** End of report ***

Open Source Tripwire 2.4 Portions copyright 2000-2018 Tripwire, Inc.  Tripwire is a registered
trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;
for details use --version. This is free software which may be redistributed
or modified only under certain conditions; see COPYING for details.
All rights reserved.

100

101

102

103

104

105

# tripwire -m c -s -c /etc/tripwire/tw.cfg

OK if it appears as follows

Open Source Tripwire(R) 2.4.3.7 Integrity Check Report

Report generated by: root

Report created on: Sat 02 Aug 2025 09:32:51 AM JST

Database last updated on: Never

===============================================================================

Report Summary:

===============================================================================

Host name: Lepard

Host IP address: 192.168.11.83

Host ID: None

Policy file used: /etc/tripwire/tw.pol

Configuration file used: /etc/tripwire/tw.cfg

Database file used: /var/lib/tripwire/Lepard.twd

Command line used: tripwire -m c -s -c /etc/tripwire/tw.cfg

===============================================================================

Rule Summary:

===============================================================================

-------------------------------------------------------------------------------

Section: Unix File System

-------------------------------------------------------------------------------

Rule Name Severity Level Added Removed Modified

--------- -------------- ----- ------- --------

User binaries 66 0 0 0

Tripwire Binaries 100 0 0 0

Libraries 66 0 0 0

Operating System Utilities 100 0 0 0

File System and Disk Administraton Programs

100 0 0 0

Kernel Administration Programs 100 0 0 0

Networking Programs 100 0 0 0

System Administration Programs 100 0 0 0

Hardware and Device Control Programs

100 0 0 0

System Information Programs 100 0 0 0

(/sbin/runlevel)

Application Information Programs

100 0 0 0

(/sbin/rtmon)

Critical Utility Sym-Links 100 0 0 0

Shell Binaries 100 0 0 0

Critical system boot files 100 0 0 0

* Tripwire Data Files 100 1 0 0

System boot changes 100 0 0 0

OS executables and libraries 100 0 0 0

Security Control 100 0 0 0

Critical configuration files 100 0 0 0

* Root config files 100 1 0 1

Invariant Directories 66 0 0 0

Temporary directories 33 0 0 0

Critical devices 100 0 0 0

Total objects scanned: 147676

Total violations found: 3

===============================================================================

Object Summary:

===============================================================================

-------------------------------------------------------------------------------

# Section: Unix File System

-------------------------------------------------------------------------------

Rule Name: Tripwire Data Files (/var/lib/tripwire)

Severity Level: 100

-------------------------------------------------------------------------------

Added:

"/var/lib/tripwire/Lepard.twd"

-------------------------------------------------------------------------------

Rule Name: Root config files (/root)

Severity Level: 100

-------------------------------------------------------------------------------

Added:

"/root/test.txt"

Modified:

"/root"

===============================================================================

Error Report:

===============================================================================

No Errors

-------------------------------------------------------------------------------

*** End of report ***

trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;

for details use --version. This is free software which may be redistributed

or modified only under certain conditions; see COPYING for details.

Delete test files

# rm -f /root/test.txt

1	# rm -f /root/test.txt

⑧Tripwire Scheduled Scripts

# cd /var/www/system
# vi tripwire.sh

1 2	# cd /var/www/system # vi tripwire.sh

Contents of tripwire.sh

#!/bin/bash

PATH=/usr/sbin:/usr/bin:/bin:/usr/local/tripwire/sbin

# Passphrase setting
LOCALPASS= ←local passphrase
SITEPASS= 　←site passphrase
cd /etc/tripwire

# Tripwire check run
tripwire -m c -s -c tw.cfg|mail -s "Tripwire(R) Integrity Check Report in `hostname`" root

# Policy File Update
twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt
perl twpolmake.pl twpol.txt > twpol.txt.new
twadmin -m P -c tw.cfg -p tw.pol -S site.key -Q $SITEPASS twpol.txt.new > /dev/null
rm -f twpol.txt* *.bak

# Database Update
rm -f /usr/local/tripwire/lib/tripwire/*.twd*
tripwire -m i -s -c tw.cfg -P $LOCALPASS

#!/bin/bash

PATH=/usr/sbin:/usr/bin:/bin:/usr/local/tripwire/sbin

# Passphrase setting

LOCALPASS= ←local passphrase

SITEPASS= 　←site passphrase

cd /etc/tripwire

# Tripwire check run

tripwire -m c -s -c tw.cfg|mail -s "Tripwire(R) Integrity Check Report in `hostname`" root

# Policy File Update

twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt

perl twpolmake.pl twpol.txt > twpol.txt.new

twadmin -m P -c tw.cfg -p tw.pol -S site.key -Q $SITEPASS twpol.txt.new > /dev/null

rm -f twpol.txt* *.bak

# Database Update

rm -f /usr/local/tripwire/lib/tripwire/*.twd*

tripwire -m i -s -c tw.cfg -P $LOCALPASS

# chmod 700 tripwire.sh

Add to cron
# crontab -e
0 3 * * * /var/www/system/tripwire.sh

# chmod 700 tripwire.sh

Add to cron

# crontab -e

0 3 * * * /var/www/system/tripwire.sh

Reference: Script for reporting results by e-mail

#!/bin/bash

PATH=/usr/sbin:/usr/bin:/bin:/usr/local/tripwire/sbin

# Passphrase setting
LOCALPASS=xxxxx # local passphrase
SITEPASS=xxxxx # site passphrase

#Specify e-mail address for notification
MAIL="<your mailaddress> "

cd /etc/tripwire

# Tripwire check run
tripwire -m c -s -c tw.cfg|mail -s "Tripwire(R) Integrity Check Report in `hostname`" $MAIL

# Policy File Update
twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt
perl twpolmake.pl twpol.txt > twpol.txt.new
twadmin -m P -c tw.cfg -p tw.pol -S site.key -Q $SITEPASS twpol.txt.new > /dev/null
rm -f twpol.txt* *.bak

# Database update
rm -f /usr/local/tripwire/lib/tripwire/*.twd*
tripwire -m i -s -c tw.cfg -P $LOCALPASS

#!/bin/bash

PATH=/usr/sbin:/usr/bin:/bin:/usr/local/tripwire/sbin

# Passphrase setting

LOCALPASS=xxxxx # local passphrase

SITEPASS=xxxxx # site passphrase

#Specify e-mail address for notification

MAIL="<your mailaddress> "

cd /etc/tripwire

# Tripwire check run

tripwire -m c -s -c tw.cfg|mail -s "Tripwire(R) Integrity Check Report in `hostname`" $MAIL

# Policy File Update

twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt

perl twpolmake.pl twpol.txt > twpol.txt.new

twadmin -m P -c tw.cfg -p tw.pol -S site.key -Q $SITEPASS twpol.txt.new > /dev/null

rm -f twpol.txt* *.bak

# Database update

rm -f /usr/local/tripwire/lib/tripwire/*.twd*

tripwire -m i -s -c tw.cfg -P $LOCALPASS

Confirmation that the results of the tripwire execution are notified to the specified e-mail address

# /var/www/system/tripwire.sh

1	# /var/www/system/tripwire.sh

Chkrootkit

Install a rootkit detection tool called chkrootkit to check whether a rootkit has been installed on the Linux server.
Since chkrootkit is checked using the following command, it is desirable to install it in the early stages after Linux installation, since it is useless after the command itself has been tampered with so that rootkit cannot be detected.

[Commands used by chkrootkit]
awk, cut, echo, egrep, find, head, id, ls, netstat, ps, strings, sed, uname

Note that chkrootkit can only detect known rootkits and cannot detect new rootkits.

①Download and install chkrootkit

# cd /usr/local/src
# wget https://launchpad.net/chkrootkit/main/0.55/+download/chkrootkit-0.55.tar.gz
# tar xvf chkrootkit-0.55.tar.gz

# cd /usr/local/src

# wget https://launchpad.net/chkrootkit/main/0.55/+download/chkrootkit-0.55.tar.gz

# tar xvf chkrootkit-0.55.tar.gz

➁Create /root/bin directory and move chkrootkit command to that directory

# mkdir -p /root/bin
# mv chkrootkit-0.55/chkrootkit /root/bin

1 2	# mkdir -p /root/bin # mv chkrootkit-0.55/chkrootkit /root/bin

➂Check chkrootkit.

# chkrootkit | grep INFECTED
If nothing is displayed, no problem.

1 2	# chkrootkit \| grep INFECTED If nothing is displayed, no problem.

If the following error occurs
egrep: warning: egrep is obsolescent; using grep -E

# mv /usr/bin/egrep /usr/bin/egrep.backup
# echo 'grep -E $@' > /usr/bin/egrep
# chmod a+x /usr/bin/egrep

# mv /usr/bin/egrep /usr/bin/egrep.backup

# echo 'grep -E $@' > /usr/bin/egrep

# chmod a+x /usr/bin/egrep

④Create chkrootkit periodic execution script and change permissions
Create chkrootkit execution script in a directory where it is automatically executed daily

# vi /etc/cron.daily/chkrootkit

1	# vi /etc/cron.daily/chkrootkit

Scheduled Script Contents

#!/bin/bash
 
PATH=/usr/bin:/bin:/root/bin
 
LOG=/tmp/$(basename ${0})
 
# Run chkrootkit
chkrootkit > $LOG 2>&1
 
# log output
cat $LOG | logger -t $(basename ${0})
 
# SMTPS bindshell false positive response
if [ ! -z "$(grep 465 $LOG)" ] && \
[ -z $(/usr/sbin/lsof -i:465|grep bindshell) ]; then
sed -i '/465/d' $LOG
fi
 
# Support for Suckit false positives when updating upstart package
if [ ! -z "$(grep Suckit $LOG)" ] && \
[ -z "$(rpm -V `rpm -qf /sbin/init`)" ]; then
sed -i '/Suckit/d' $LOG
fi
 
# Send mail to root only when rootkit is detected
[ ! -z "$(grep INFECTED $LOG)" ] && \
grep INFECTED $LOG | mail -s "chkrootkit report in `hostname`" root

#!/bin/bash

PATH=/usr/bin:/bin:/root/bin

LOG=/tmp/$(basename ${0})

# Run chkrootkit

chkrootkit > $LOG 2>&1

# log output

cat $LOG | logger -t $(basename ${0})

# SMTPS bindshell false positive response

if [ ! -z "$(grep 465 $LOG)" ] && \

[ -z $(/usr/sbin/lsof -i:465|grep bindshell) ]; then

sed -i '/465/d' $LOG

# Support for Suckit false positives when updating upstart package

if [ ! -z "$(grep Suckit $LOG)" ] && \

[ -z "$(rpm -V `rpm -qf /sbin/init`)" ]; then

sed -i '/Suckit/d' $LOG

# Send mail to root only when rootkit is detected

[ ! -z "$(grep INFECTED $LOG)" ] && \

grep INFECTED $LOG | mail -s "chkrootkit report in `hostname`" root

Add execution permission to chkrootkit execution script

# chmod 700 /etc/cron.daily/chkrootkit

1	# chmod 700 /etc/cron.daily/chkrootkit

⑤Backup commands used by chkrootkit

If the commands used by chkrootkit are tampered with, rootkit will not be detected.
Back up these commands.
If necessary, run chkrootkit with the backed up command

# cd /root
# mkdir /root/chkrootkit_cmd
# cp `which --skip-alias awk cut echo egrep find head id ls netstat ps strings sed ssh uname` chkrootkit_cmd/
# ls -l /root/chkrootkit_cmd/
total 2656
-rwxr-xr-x 1 root root 754360 Aug  2 10:31 awk
-rwxr-xr-x 1 root root  53240 Aug  2 10:31 cut
-rwxr-xr-x 1 root root  36496 Aug  2 10:31 echo
-rwxr-xr-x 1 root root     13 Aug  2 10:31 egrep
-rwxr-xr-x 1 root root 213320 Aug  2 10:31 find
-rwxr-xr-x 1 root root  45008 Aug  2 10:31 head
-rwxr-xr-x 1 root root  44928 Aug  2 10:31 id
-rwxr-xr-x 1 root root 141192 Aug  2 10:31 ls
-rwxr-xr-x 1 root root 148672 Aug  2 10:31 netstat
-rwxr-xr-x 1 root root 120584 Aug  2 10:31 ps
-rwxr-xr-x 1 root root 119984 Aug  2 10:31 sed
-rwxr-xr-x 1 root root 938928 Aug  2 10:31 ssh
-rwxr-xr-x 1 root root  36944 Aug  2 10:31 strings
-rwxr-xr-x 1 root root  36664 Aug  2 10:31 uname

# cd /root

# mkdir /root/chkrootkit_cmd

# cp `which --skip-alias awk cut echo egrep find head id ls netstat ps strings sed ssh uname` chkrootkit_cmd/

# ls -l /root/chkrootkit_cmd/

total 2656

-rwxr-xr-x 1 root root 754360 Aug 2 10:31 awk

-rwxr-xr-x 1 root root 53240 Aug 2 10:31 cut

-rwxr-xr-x 1 root root 36496 Aug 2 10:31 echo

-rwxr-xr-x 1 root root 13 Aug 2 10:31 egrep

-rwxr-xr-x 1 root root 213320 Aug 2 10:31 find

-rwxr-xr-x 1 root root 45008 Aug 2 10:31 head

-rwxr-xr-x 1 root root 44928 Aug 2 10:31 id

-rwxr-xr-x 1 root root 141192 Aug 2 10:31 ls

-rwxr-xr-x 1 root root 148672 Aug 2 10:31 netstat

-rwxr-xr-x 1 root root 120584 Aug 2 10:31 ps

-rwxr-xr-x 1 root root 119984 Aug 2 10:31 sed

-rwxr-xr-x 1 root root 938928 Aug 2 10:31 ssh

-rwxr-xr-x 1 root root 36944 Aug 2 10:31 strings

-rwxr-xr-x 1 root root 36664 Aug 2 10:31 uname

⑥Run chkrootkit on the copied command

# chkrootkit -p /root/chkrootkit_cmd | grep INFECTED

1	# chkrootkit -p /root/chkrootkit_cmd \| grep INFECTED

If nothing is displayed, no problem.

⑦Compresses backed up commands

# tar zcvf chkrootkit_cmd.tar.gz chkrootkit_cmd
chkrootkit_cmd/
chkrootkit_cmd/awk
chkrootkit_cmd/cut
chkrootkit_cmd/echo
chkrootkit_cmd/egrep
chkrootkit_cmd/find
chkrootkit_cmd/head
chkrootkit_cmd/id
chkrootkit_cmd/ls
chkrootkit_cmd/netstat
chkrootkit_cmd/ps
chkrootkit_cmd/strings
chkrootkit_cmd/sed
chkrootkit_cmd/ssh
chkrootkit_cmd/uname

# tar zcvf chkrootkit_cmd.tar.gz chkrootkit_cmd

chkrootkit_cmd/

chkrootkit_cmd/awk

chkrootkit_cmd/cut

chkrootkit_cmd/echo

chkrootkit_cmd/egrep

chkrootkit_cmd/find

chkrootkit_cmd/head

chkrootkit_cmd/id

chkrootkit_cmd/ls

chkrootkit_cmd/netstat

chkrootkit_cmd/ps

chkrootkit_cmd/strings

chkrootkit_cmd/sed

chkrootkit_cmd/ssh

chkrootkit_cmd/uname

# ls -l
total 199864
-rw-------.  1 root  root      1147 Jul 26 22:13 anaconda-ks.cfg
-rw-------   1 root  root      1538 Aug  1 17:22 appid_stats.log
drwxr-xr-x   2 root  root        24 Aug  2 09:44 bin
drwxr-xr-x   2 root  root       172 Aug  2 10:31 chkrootkit_cmd
---------------------------------------------------------------

# ls -l

total 199864

-rw-------. 1 root root 1147 Jul 26 22:13 anaconda-ks.cfg

-rw------- 1 root root 1538 Aug 1 17:22 appid_stats.log

drwxr-xr-x 2 root root 24 Aug 2 09:44 bin

drwxr-xr-x 2 root root 172 Aug 2 10:31 chkrootkit_cmd

---------------------------------------------------------------

⑧Send chkrootkit use command (compressed version) to root by e-mail

# echo|mail -a chkrootkit_cmd.tar.gz -s chkrootkit_cmd.tar.gz root

1	# echo\|mail -a chkrootkit_cmd.tar.gz -s chkrootkit_cmd.tar.gz root

⑨Download and save chkrootkit_cmd.tar.gz file to Windows

⑩Delete commands on the backed up server

# rm -f chkrootkit_cmd.tar.gz

1	# rm -f chkrootkit_cmd.tar.gz

Logwatch

①Install

# dnf install logwatch -y

1	# dnf install logwatch -y

②Edit configuration file

# cat /usr/share/logwatch/default.conf/logwatch.conf >> /etc/logwatch/conf/logwatch.conf

# vi /etc/logwatch/conf/logwatch.conf

Per Line 77 : Add
#MailTo = root
MailTo = [Mail address]

Per Line 116 : Set the level of detail for log notifications
#Detail = Low
Detail = High

# cat /usr/share/logwatch/default.conf/logwatch.conf >> /etc/logwatch/conf/logwatch.conf

# vi /etc/logwatch/conf/logwatch.conf

Per Line 77 : Add

#MailTo = root

MailTo = [Mail address]

Per Line 116 : Set the level of detail for log notifications

#Detail = Low

Detail = High

③Output Logwatch reports

# logwatch --output stdout

1	# logwatch --output stdout

It will appear as follows

################### Logwatch 7.11 (07/22/24) ####################
        Processing Initiated: Sat Aug  2 10:36:16 2025
        Date Range Processed: yesterday
                              ( 2025-Aug-01 )
                              Period is day.
        Detail Level of Output: 10
        Type of Output/Format: stdout / text
        Logfiles for Host: Lepard
 ##################################################################

 --------------------- Kernel Audit Begin ------------------------

  Number of audit daemon starts: 2

  Number of audit initializations: 2

 **Unmatched Entries**
    auditd[829]: audit dispatcher initialized with q_depth=2000 and 1 active plugins: 1 Time(s)
    auditd[832]: audit dispatcher initialized with q_depth=2000 and 1 active plugins: 1 Time(s)

 ---------------------- Kernel Audit End -------------------------
---------------------------------
---------------------------------
 --------------------- Disk Space Begin ------------------------

 Filesystem           Size  Used Avail Use% Mounted on
 /dev/mapper/ol-root   17G   10G  7.0G  60% /
 /dev/nvme0n1p2       960M  340M  621M  36% /boot


 ---------------------- Disk Space End -------------------------


 --------------------- lm_sensors output Begin ------------------------

 nvme-pci-0b00
 Adapter: PCI adapter
 Composite:   +11758.9 C


 ---------------------- lm_sensors output End -------------------------


 ###################### Logwatch End #########################

################### Logwatch 7.11 (07/22/24) ####################

Processing Initiated: Sat Aug 2 10:36:16 2025

Date Range Processed: yesterday

( 2025-Aug-01 )

Period is day.

Detail Level of Output: 10

Type of Output/Format: stdout / text

Logfiles for Host: Lepard

##################################################################

--------------------- Kernel Audit Begin ------------------------

Number of audit daemon starts: 2

Number of audit initializations: 2

**Unmatched Entries**

auditd[829]: audit dispatcher initialized with q_depth=2000 and 1 active plugins: 1 Time(s)

auditd[832]: audit dispatcher initialized with q_depth=2000 and 1 active plugins: 1 Time(s)

---------------------- Kernel Audit End -------------------------

---------------------------------

--------------------- Disk Space Begin ------------------------

Filesystem Size Used Avail Use% Mounted on

/dev/mapper/ol-root 17G 10G 7.0G 60% /

/dev/nvme0n1p2 960M 340M 621M 36% /boot

---------------------- Disk Space End -------------------------

--------------------- lm_sensors output Begin ------------------------

nvme-pci-0b00

Adapter: PCI adapter

Composite: +11758.9 C

---------------------- lm_sensors output End -------------------------

###################### Logwatch End #########################

④Test to see if the report arrives at the address you set. Check if you receive a log report email like the one above.

# /etc/cron.daily/0logwatch

1	# /etc/cron.daily/0logwatch

DNS Update Script

Each time the global IP changes, which happens when the network is disconnected or the router disconnects and reboots, the dynamic DNS must be accessed to inform the user that the global IP has changed.
DiCE used to do that work automatically, but since we can no longer use 32-bit software in OracleLinux10

We will create a dedicated script and run it periodically in Cron

This time we will set up DNS in Valudomain.

# cd /var/www/system
# vi valuedomain.sh

1 2	# cd /var/www/system # vi valuedomain.sh

Contents of valuedomain.sh

#/bin/bash

#VARIABLES
DOMAINNAME="example.com"
PASSWORD="password"
HOSTNAME="*"　←Fill in the hostname if you want to set a specific host, or “*” if you want to target all hosts.
MYIP=""

# External IP Acquisition
MYIP=`wget -q -O - "https://dyn.value-domain.com/cgi-bin/dyn.fcg?ip"`

sleep 5
# Update process
wget -q -O - "https://dyn.value-domain.com/cgi-bin/dyn.fcg?d=$DOMAINNAME&p=$PASSWORD&h=$HOSTNAME&i=$MYIP"

#/bin/bash

#VARIABLES

DOMAINNAME="example.com"

PASSWORD="password"

HOSTNAME="*"　←Fill in the hostname if you want to set a specific host, or “*” if you want to target all hosts.

MYIP=""

# External IP Acquisition

MYIP=`wget -q -O - "https://dyn.value-domain.com/cgi-bin/dyn.fcg?ip"`

sleep 5

# Update process

wget -q -O - "https://dyn.value-domain.com/cgi-bin/dyn.fcg?d=$DOMAINNAME&p=$PASSWORD&h=$HOSTNAME&i=$MYIP"

# chmod +x valuedomain.sh

1	# chmod +x valuedomain.sh

I'll run it.

# # /var/www/system/valudomain.sh

status=0
OK

# # /var/www/system/valudomain.sh

status=0

Introduce disk usage check script

1. Script Creation

# cd /var/www/system
# vi disk_capacity_check.sh

1 2	# cd /var/www/system # vi disk_capacity_check.sh

Contents of disk_capacity_check.sh

#!/bin/bash

# Designation of e-mail address to be notified
MAIL="<your mailaddress>"

DVAL=`/bin/df / | /usr/bin/tail -1 | /bin/sed 's/^.* \([0-9]*\)%.*$/\1/'`

if [ $DVAL -gt 80 ]; then
echo "Disk usage alert: $DVAL %" | mail -s "Disk Space Alert in `hostname`" $MAIL
fi

#!/bin/bash

# Designation of e-mail address to be notified

MAIL="<your mailaddress>"

DVAL=`/bin/df / | /usr/bin/tail -1 | /bin/sed 's/^.* $[0-9]*$%.*$/\1/'`

if [ $DVAL -gt 80 ]; then

echo "Disk usage alert: $DVAL %" | mail -s "Disk Space Alert in `hostname`" $MAIL

# chmod 700 disk_capacity_check.sh

1	# chmod 700 disk_capacity_check.sh

2. Execution Confirmation

①Check current usage rates

# df -h

# df -h

It appears as follows

Filesystem           Size  Used Avail Use% Mounted on
/dev/mapper/ol-root   17G   10G  7.0G  59% /
devtmpfs             4.0M     0  4.0M   0% /dev
tmpfs                1.7G     0  1.7G   0% /dev/shm
tmpfs                693M  9.2M  684M   2% /run
tmpfs                1.0M     0  1.0M   0% /run/credentials/systemd-journald.service
/dev/loop0            55M   55M     0 100% /var/lib/snapd/snap/certbot/4737
/dev/loop2            50M   50M     0 100% /var/lib/snapd/snap/snapd/24792
/dev/loop1            67M   67M     0 100% /var/lib/snapd/snap/core24/1055
/dev/nvme0n1p2       960M  340M  621M  36% /boot
tmpfs                1.0M     0  1.0M   0% /run/credentials/getty@tty1.service
tmpfs                347M   16K  347M   1% /run/user/1000

Filesystem Size Used Avail Use% Mounted on

/dev/mapper/ol-root 17G 10G 7.0G 59% /

devtmpfs 4.0M 0 4.0M 0% /dev

tmpfs 1.7G 0 1.7G 0% /dev/shm

tmpfs 693M 9.2M 684M 2% /run

tmpfs 1.0M 0 1.0M 0% /run/credentials/systemd-journald.service

/dev/loop0 55M 55M 0 100% /var/lib/snapd/snap/certbot/4737

/dev/loop2 50M 50M 0 100% /var/lib/snapd/snap/snapd/24792

/dev/loop1 67M 67M 0 100% /var/lib/snapd/snap/core24/1055

/dev/nvme0n1p2 960M 340M 621M 36% /boot

tmpfs 1.0M 0 1.0M 0% /run/credentials/getty@tty1.service

tmpfs 347M 16K 347M 1% /run/user/1000

②Create a dummy file to achieve at least 80% utilization(In the example, it is called "dummyfile" and is about 6G)

# dd if=/dev/zero of=dummyfile bs=1M count=6000

1	# dd if=/dev/zero of=dummyfile bs=1M count=6000

③check again
Confirm that it is above 80% by performing the following

# df -h

# df -h

④Run check scripts

# /var/www/system/disk_capacity_check.sh

1	# /var/www/system/disk_capacity_check.sh

You will receive an email to the email address you have set up, stating something like "Disk usage alert: 94 %".

⑤Delete "dummyfile"

# rm dummyfile

1	# rm dummyfile

⑥Periodic Execution Setting

# crontab -e
Add the following
30 2 * * * /var/www/system/disk_capacity_check.sh

# crontab -e

Add the following

30 2 * * * /var/www/system/disk_capacity_check.sh

Go to top