Click here for "Safe Air Conditioner Repair and Proper Freon Recovery".(Japanese Version)

OracleLinux9.1 : Tripwire , Chkrootkit , Logwatch , Disk Usage Check Script


1.Download and installation

2.Passphrase setting

Set site passphrase and local passphrase

3.Tripwire Configuration

①Configuration File Edit

②Create a Tripwire configuration file (cryptographically signed version)

③Delete Tripwire configuration file (text version)

④Policy File Settings

Contents of

⑤Policy File Optimizations

⑥Create policy file (cryptographically signed version) based on optimized policy file
⑦Create database and check operation

Delete test files

⑧Tripwire Scheduled Scripts

Contents of

⑨Tripwire Autorun Script Execution Settings

Reference: Script for reporting results by e-mail

Confirmation that the results of the tripwire execution are notified to the specified e-mail address


①Download and install chkrootkit

➁Create /root/bin directory and move chkrootkit command to that directory
➂Check chkrootkit.
Checking `chsh'... INFECTED

If the above display appears, it is probably a false positive.

④Create chkrootkit periodic execution script and change permissions

Scheduled Script Contents

Add execution permission to chkrootkit execution script

⑤Backup commands used by chkrootkit
If the commands used by chkrootkit are tampered with, rootkit will not be detected.
Back up these commands.
If necessary, run chkrootkit with the backed up command

⑥Run chkrootkit on the copied command

If nothing is displayed, no problem.

⑦Compresses backed up commands
⑧Send chkrootkit use command (compressed version) to root by e-mail
⑨Download and save chkrootkit_cmd.tar.gz file to Windows
⑩Delete commands on the backed up server



②Edit configuration file

③Output Logwatch reports

It will appear as follows

④Test to see if the report arrives at the address you set. Check if you receive a log report email like the one above.

Introduce disk usage check script

1. Script Creation

Contents of

2. Execution Confirmation

①Check current usage rates

It appears as follows

②Create a dummy file to achieve at least 80% utilization

③check again
④Run check scripts
You will receive an email to the email address you have set up, stating something like "Disk usage alert: 89 %".

⑤Delete "dummyfile"

⑥Periodic Execution Setting
Copied title and URL