Click here for "Safe Air Conditioner Repair and Proper Freon Recovery".(Japanese Version)

OracleLinux9.3 ; Tripwire , Chkrootkit , Logwatch , Disk Usage Check Script


1.Download and installation

2.Passphrase setting

Set site passphrase and local passphrase

3.Tripwire Configuration

Configuration File Edit

Create a Tripwire configuration file (cryptographically signed version)

Delete Tripwire configuration file (text version)

Policy File Settings

Contents of

Policy File Optimizations

Create policy file (cryptographically signed version) based on optimized policy file

Create database and check operation

Create test files

Check Tripwire operation

Delete test files

Tripwire Scheduled Scripts

Contents of

Reference: Script for reporting results by e-mail

Confirmation that the results of the tripwire execution are notified to the specified e-mail address


Download and install chkrootkit

Create /root/bin directory and move chkrootkit command to that directory

Check chkrootkit.

Checking `chsh'... INFECTED
If the above display appears, it is probably a false positive.

Create chkrootkit periodic execution script and change permissions
Create chkrootkit execution script in a directory where it is automatically executed daily

Scheduled Script Contents

Add execution permission to chkrootkit execution script

Backup commands used by chkrootkit

If the commands used by chkrootkit are tampered with, rootkit will not be detected.
Back up these commands.
If necessary, run chkrootkit with the backed up command

Run chkrootkit on the copied command

If nothing is displayed, no problem.

Compresses backed up commands

Send chkrootkit use command (compressed version) to root by e-mail

Download and save chkrootkit_cmd.tar.gz file to Windows

Delete commands on the backed up server



Edit configuration file

Output Logwatch reports

It will appear as follows

④Test to see if the report arrives at the address you set. Check if you receive a log report email like the one above.

Introduce disk usage check script

3.1 Script Creation

Contents of

3.2  Execution Confirmation

①Check current usage rates

It appears as follows

②Create a dummy file to achieve at least 80% utilization(In the example, it is called "dummyfile" and is about 20G)

③check again
Confirm that it is above 80% by performing the following

④Run check scripts

You will receive an email to the email address you have set up, stating something like "Disk usage alert: 92 %".

⑤Delete "dummyfile"

⑥Periodic Execution Setting

Copied title and URL