OracleLinux9.4 ; Tripwire , Chkrootkit , Logwatch , Disk Usage Check Script

Tripwire

1.Download and installation

2.Passphrase setting

Set site passphrase and local passphrase

3.Tripwire Configuration

Configuration File Edit

Create a Tripwire configuration file (cryptographically signed version)

Delete Tripwire configuration file (text version)

Policy File Settings

Contents of twpolmake.pl

Policy File Optimizations

Create policy file (cryptographically signed version) based on optimized policy file

Create database and check operation

Create test files

Check Tripwire operation

Delete test files

Tripwire Scheduled Scripts

Contents of tripwire.sh

Reference: Script for reporting results by e-mail

Confirmation that the results of the tripwire execution are notified to the specified e-mail address

Chkrootkit

Install a rootkit detection tool called chkrootkit to check whether a rootkit has been installed on the Linux server.
Since chkrootkit is checked using the following command, it is desirable to install it in the early stages after Linux installation, since it is useless after the command itself has been tampered with so that rootkit cannot be detected.

[Commands used by chkrootkit]
awk, cut, echo, egrep, find, head, id, ls, netstat, ps, strings, sed, uname

Note that chkrootkit can only detect known rootkits and cannot detect new rootkits.

Download and install chkrootkit

Create /root/bin directory and move chkrootkit command to that directory

Check chkrootkit.

Checking `chsh'... INFECTED
The chsh command changes the shell. If you do not use it, rename the file /usr/bin/chsh to chsh.bak and the display will disappear.
There is no problem even if the file is not renamed.

Create chkrootkit periodic execution script and change permissions
Create chkrootkit execution script in a directory where it is automatically executed daily

Scheduled Script Contents

Add execution permission to chkrootkit execution script

Backup commands used by chkrootkit

If the commands used by chkrootkit are tampered with, rootkit will not be detected.
Back up these commands.
If necessary, run chkrootkit with the backed up command

Run chkrootkit on the copied command

If nothing is displayed, no problem.

Compresses backed up commands

Send chkrootkit use command (compressed version) to root by e-mail

Download and save chkrootkit_cmd.tar.gz file to Windows

Delete commands on the backed up server

Logwatch

①Install

Edit configuration file

Output Logwatch reports

It will appear as follows

Test to see if the report arrives at the address you set. Check if you receive a log report email like the one above.

Introduce disk usage check script

① Script Creation

Contents of disk_capacity_check.sh

➁ Execution Confirmation

Check current usage rates

It appears as follows

Create a dummy file to achieve at least 80% utilization(In the example, it is called "dummyfile" and is about 8G)

check again
Confirm that it is above 80% by performing the following

Run check scripts

You will receive an email to the email address you have set up, stating something like "Disk usage alert: 85 %".

Delete "dummyfile"

Periodic Execution Setting

Copied title and URL