RockyLinux 9.1 ; Suricata , Tripwire , Chkrootkit インストール

Contents

Suricata インストール
Tripwire インストール
Chkrootkit インストール

Suricata インストール

SURICATA IDS/IPSはネットワーク上の通信を監視し、不審なトラフィックを検知するオープンソースのIDSです。基本的な仕組みはシグネチャ型であるため、あらかじめ設定した不正な通信を検知できます。また、Suricataは検知だけでなく防御も行えることが特徴です。

1.事前準備

①EPEL リポジトリをシステム上で有効化する

# dnf -y install epel-release

1	# dnf -y install epel-release

②システムのアップデート

# dnf update -y

1	# dnf update -y

2.Suricata のインストールと設定

①Suricata のインストール

#  dnf install suricata

バージョンの確認
# suricata -V
This is Suricata version 6.0.9 RELEASE

# dnf install suricata

バージョンの確認

# suricata -V

This is Suricata version 6.0.9 RELEASE

②Suricataがネットワークパケットを検査するインターフェースとIPアドレスを決定

# ip --brief add
lo               UNKNOWN        127.0.0.1/8 ::1/128
ens33            UP             192.168.11.83/24 fe80::20c:29ff:fe9f:8787/64

# ip --brief add

lo UNKNOWN 127.0.0.1/8 ::1/128

ens33 UP 192.168.11.83/24 fe80::20c:29ff:fe9f:8787/64

③設定ファイルを編集

#  vi /etc/suricata/suricata.yaml

# 15行目 : varsセクションで、ネットワークを定義する
HOME_NET: "[192.168.11.0/24]"
EXTRNAL_NET: "!$HOME_NET"

# 589行目 : af-packetセクションのインターフェース名を設定
af-packet:
    - interface: ens33

# vi /etc/suricata/suricata.yaml

# 15行目 : varsセクションで、ネットワークを定義する

HOME_NET: "[192.168.11.0/24]"

EXTRNAL_NET: "!$HOME_NET"

# 589行目 : af-packetセクションのインターフェース名を設定

af-packet:

- interface: ens33

# vi /etc/sysconfig/suricata

# 8行目 :インターフェイスを指定
# Add options to be passed to the daemon
OPTIONS="-i ens33 --user suricata "

# vi /etc/sysconfig/suricata

# 8行目 :インターフェイスを指定

# Add options to be passed to the daemon

OPTIONS="-i ens33 --user suricata "

④Suricataのルール更新

# suricata-update

1	# suricata-update

<Warning> -- [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol sip enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
上記のような警告が出るが無視できるものと思われるので、このまま進めます

⑤Suricataの起動

# systemctl enable --now suricata
Created symlink /etc/systemd/system/multiuser.target.wants/suricata.service → /usr/lib/systemd/system/suricata.service.

1 2	# systemctl enable --now suricata Created symlink /etc/systemd/system/multiuser.target.wants/suricata.service → /usr/lib/systemd/system/suricata.service.

⑥Suricataの起動確認

# systemctl status suricata
● suricata.service - Suricata Intrusion Detection Service
     Loaded: loaded (/usr/lib/systemd/system/suricata.service; enabled; vendor preset: >
     Active: active (running) since Sun 2023-01-08 15:54:47 JST; 13s ago
       Docs: man:suricata(1)
    Process: 41905 ExecStartPre=/bin/rm -f /var/run/suricata.pid (code=exited, status=0>
   Main PID: 41906 (Suricata-Main)
      Tasks: 1 (limit: 22942)
     Memory: 431.6M
        CPU: 12.807s
     CGroup: /system.slice/suricata.service
             mq41906 /sbin/suricata -c /etc/suricata/suricata.yaml --pidfile /var/run/s>

Jan 08 15:54:47 Lepard systemd[1]: Starting Suricata Intrusion Detection Service...
Jan 08 15:54:47 Lepard systemd[1]: Started Suricata Intrusion Detection Service.
Jan 08 15:54:47 Lepard suricata[41906]: 8/1/2023 -- 15:54:47 - <Notice> - This is Suric

# systemctl status suricata

● suricata.service - Suricata Intrusion Detection Service

Loaded: loaded (/usr/lib/systemd/system/suricata.service; enabled; vendor preset: >

Active: active (running) since Sun 2023-01-08 15:54:47 JST; 13s ago

Docs: man:suricata(1)

Process: 41905 ExecStartPre=/bin/rm -f /var/run/suricata.pid (code=exited, status=0>

Main PID: 41906 (Suricata-Main)

Tasks: 1 (limit: 22942)

Memory: 431.6M

CPU: 12.807s

CGroup: /system.slice/suricata.service

mq41906 /sbin/suricata -c /etc/suricata/suricata.yaml --pidfile /var/run/s>

Jan 08 15:54:47 Lepard systemd[1]: Starting Suricata Intrusion Detection Service...

Jan 08 15:54:47 Lepard systemd[1]: Started Suricata Intrusion Detection Service.

Jan 08 15:54:47 Lepard suricata[41906]: 8/1/2023 -- 15:54:47 - <Notice> - This is Suric

ログを確認

# tail /var/log/suricata/suricata.log
8/1/2023 -- 15:54:47 - <Info> - stats output device (regular) initialized: stats.log
8/1/2023 -- 15:54:47 - <Info> - Running in live mode, activating unix socket
8/1/2023 -- 15:54:55 - <Info> - 1 rule files processed. 32473 rules successfully loaded, 0 rules failed
8/1/2023 -- 15:54:55 - <Info> - Threshold config parsed: 0 rule(s) found
8/1/2023 -- 15:54:56 - <Info> - 32476 signatures processed. 1378 are IP-only rules, 5172 are inspecting packet payload, 25723 inspect application layer, 108 are decoder event only
8/1/2023 -- 15:55:09 - <Info> - Going to use 2 thread(s)
8/1/2023 -- 15:55:09 - <Info> - Running in live mode, activating unix socket
8/1/2023 -- 15:55:09 - <Info> - Using unix socket file '/var/run/suricata/suricata-command.socket'
8/1/2023 -- 15:55:09 - <Notice> - all 2 packet processing threads, 4 management threads initialized, engine started.
8/1/2023 -- 15:55:09 - <Info> - All AFP capture threads are running.

# tail /var/log/suricata/suricata.log

8/1/2023 -- 15:54:47 - <Info> - stats output device (regular) initialized: stats.log

8/1/2023 -- 15:54:47 - <Info> - Running in live mode, activating unix socket

8/1/2023 -- 15:54:55 - <Info> - 1 rule files processed. 32473 rules successfully loaded, 0 rules failed

8/1/2023 -- 15:54:55 - <Info> - Threshold config parsed: 0 rule(s) found

8/1/2023 -- 15:54:56 - <Info> - 32476 signatures processed. 1378 are IP-only rules, 5172 are inspecting packet payload, 25723 inspect application layer, 108 are decoder event only

8/1/2023 -- 15:55:09 - <Info> - Going to use 2 thread(s)

8/1/2023 -- 15:55:09 - <Info> - Running in live mode, activating unix socket

8/1/2023 -- 15:55:09 - <Info> - Using unix socket file '/var/run/suricata/suricata-command.socket'

8/1/2023 -- 15:55:09 - <Notice> - all 2 packet processing threads, 4 management threads initialized, engine started.

8/1/2023 -- 15:55:09 - <Info> - All AFP capture threads are running.

統計情報を確認するには、stats.log ファイルを確認します(デフォルトで8秒ごとに更新)

# tail -f /var/log/suricata/stats.log

1	# tail -f /var/log/suricata/stats.log

より高度な出力であるEVE JSONは、以下のコマンドで生成することができる

# tail -f /var/log/suricata/eve.json

1	# tail -f /var/log/suricata/eve.json

3.Suricata のテスト

①curl ユーティリティで ping テストを実行

# curl http://testmynids.org/uid/index.html
uid=0(root) gid=0(root) groups=0(root)

1 2	# curl http://testmynids.org/uid/index.html uid=0(root) gid=0(root) groups=0(root)

②ログに記録されたかどうかを調べるため、アラートログを確認

# cat /var/log/suricata/fast.log
01/08/2023-15:57:45.497041  [**] [1:2260002:1] SURICATA Applayer Detect protocol only one direction [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 192.168.11.83:25 -> 141.98.11.112:46182
01/08/2023-15:57:49.788108  [**] [1:2220000:1] SURICATA SMTP invalid reply [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 192.168.11.83:25 -> 46.148.40.150:23296

# cat /var/log/suricata/fast.log

01/08/2023-15:57:45.497041 [**] [1:2260002:1] SURICATA Applayer Detect protocol only one direction [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 192.168.11.83:25 -> 141.98.11.112:46182

01/08/2023-15:57:49.788108 [**] [1:2220000:1] SURICATA SMTP invalid reply [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 192.168.11.83:25 -> 46.148.40.150:23296

4.Suricata Rulesの設定

①Suricataにパッケージされているルールセットの表示

# ls -al /var/lib/suricata/rules/
total 22516
drwxr-s--- 2 root     suricata       57 Jan  8 15:53 .
drwxrws--- 4 suricata suricata       33 Jan  8 15:53 ..
-rw-r--r-- 1 root     suricata     3228 Jan  8 15:53 classification.config
-rw-r--r-- 1 root     suricata 23049816 Jan  8 15:53 suricata.rules

# ls -al /var/lib/suricata/rules/

total 22516

drwxr-s--- 2 root suricata 57 Jan 8 15:53 .

drwxrws--- 4 suricata suricata 33 Jan 8 15:53 ..

-rw-r--r-- 1 root suricata 3228 Jan 8 15:53 classification.config

-rw-r--r-- 1 root suricata 23049816 Jan 8 15:53 suricata.rules

②ルールセットを提供するソースのインデックス一覧

# suricata-update list-sources

Name: et/open
  Vendor: Proofpoint
  Summary: Emerging Threats Open Ruleset
  License: MIT
Name: et/pro
  Vendor: Proofpoint
  Summary: Emerging Threats Pro Ruleset
  License: Commercial
  Replaces: et/open
  Parameters: secret-code
  Subscription: https://www.proofpoint.com/us/threat-insight/et-pro-ruleset
Name: oisf/trafficid
  Vendor: OISF
  Summary: Suricata Traffic ID ruleset
  License: MIT
Name: scwx/enhanced
  Vendor: Secureworks
  Summary: Secureworks suricata-enhanced ruleset
  License: Commercial
  Parameters: secret-code
  Subscription: https://www.secureworks.com/contact/ (Please reference CTU Countermeasures)
Name: scwx/malware
  Vendor: Secureworks
  Summary: Secureworks suricata-malware ruleset
  License: Commercial
  Parameters: secret-code
  Subscription: https://www.secureworks.com/contact/ (Please reference CTU Countermeasures)
Name: scwx/security
  Vendor: Secureworks
  Summary: Secureworks suricata-security ruleset
  License: Commercial
  Parameters: secret-code
  Subscription: https://www.secureworks.com/contact/ (Please reference CTU Countermeasures)
Name: sslbl/ssl-fp-blacklist
  Vendor: Abuse.ch
  Summary: Abuse.ch SSL Blacklist
  License: Non-Commercial
Name: sslbl/ja3-fingerprints
  Vendor: Abuse.ch
  Summary: Abuse.ch Suricata JA3 Fingerprint Ruleset
  License: Non-Commercial
Name: etnetera/aggressive
  Vendor: Etnetera a.s.
  Summary: Etnetera aggressive IP blacklist
  License: MIT
Name: tgreen/hunting
  Vendor: tgreen
  Summary: Threat hunting rules
  License: GPLv3
Name: malsilo/win-malware
  Vendor: malsilo
  Summary: Commodity malware rules
  License: MIT

# suricata-update list-sources

Name: et/open

Vendor: Proofpoint

Summary: Emerging Threats Open Ruleset

License: MIT

Name: et/pro

Vendor: Proofpoint

Summary: Emerging Threats Pro Ruleset

License: Commercial

Replaces: et/open

Parameters: secret-code

Subscription: https://www.proofpoint.com/us/threat-insight/et-pro-ruleset

Name: oisf/trafficid

Vendor: OISF

Summary: Suricata Traffic ID ruleset

License: MIT

Name: scwx/enhanced

Vendor: Secureworks

Summary: Secureworks suricata-enhanced ruleset

License: Commercial

Parameters: secret-code

Subscription: https://www.secureworks.com/contact/ (Please reference CTU Countermeasures)

Name: scwx/malware

Vendor: Secureworks

Summary: Secureworks suricata-malware ruleset

License: Commercial

Parameters: secret-code

Subscription: https://www.secureworks.com/contact/ (Please reference CTU Countermeasures)

Name: scwx/security

Vendor: Secureworks

Summary: Secureworks suricata-security ruleset

License: Commercial

Parameters: secret-code

Subscription: https://www.secureworks.com/contact/ (Please reference CTU Countermeasures)

Name: sslbl/ssl-fp-blacklist

Vendor: Abuse.ch

Summary: Abuse.ch SSL Blacklist

License: Non-Commercial

Name: sslbl/ja3-fingerprints

Vendor: Abuse.ch

Summary: Abuse.ch Suricata JA3 Fingerprint Ruleset

License: Non-Commercial

Name: etnetera/aggressive

Vendor: Etnetera a.s.

Summary: Etnetera aggressive IP blacklist

License: MIT

Name: tgreen/hunting

Vendor: tgreen

Summary: Threat hunting rules

License: GPLv3

Name: malsilo/win-malware

Vendor: malsilo

Summary: Commodity malware rules

License: MIT

③ソースを有効にする(et/openを有効にする場合)

# suricata-update enable-source et/open
8/1/2023 -- 16:03:32 - <Info> -- Using data-directory /var/lib/suricata.
8/1/2023 -- 16:03:32 - <Info> -- Using Suricata configuration /etc/suricata/suricata.yaml
8/1/2023 -- 16:03:32 - <Info> -- Using /usr/share/suricata/rules for Suricata provided rules.
8/1/2023 -- 16:03:32 - <Info> -- Found Suricata version 6.0.9 at /usr/sbin/suricata.
8/1/2023 -- 16:03:32 - <Info> -- Creating directory /var/lib/suricata/update/sources
8/1/2023 -- 16:03:32 - <Info> -- Source et/open enabled

# suricata-update enable-source et/open

8/1/2023 -- 16:03:32 - <Info> -- Using data-directory /var/lib/suricata.

8/1/2023 -- 16:03:32 - <Info> -- Using Suricata configuration /etc/suricata/suricata.yaml

8/1/2023 -- 16:03:32 - <Info> -- Using /usr/share/suricata/rules for Suricata provided rules.

8/1/2023 -- 16:03:32 - <Info> -- Found Suricata version 6.0.9 at /usr/sbin/suricata.

8/1/2023 -- 16:03:32 - <Info> -- Creating directory /var/lib/suricata/update/sources

8/1/2023 -- 16:03:32 - <Info> -- Source et/open enabled

アップデートを実行

# suricata-update

1	# suricata-update

Suricata service再起動

# systemctl restart suricata

1	# systemctl restart suricata

5.Suricata Custom Rulesの作成

①カスタマールールを含むファイルを作成

# vi /etc/suricata/rules/local.rules
下記内容を記載
alert icmp any any -> $HOME_NET any (msg:"ICMP Ping"; sid:1; rev:1;)

# vi /etc/suricata/rules/local.rules

下記内容を記載

alert icmp any any -> $HOME_NET any (msg:"ICMP Ping"; sid:1; rev:1;)

②設定ファイルを編集(新しいルールのパスを定義)

# vi /etc/suricata/suricata.yaml

# 1924行目あたりに追記
default-rule-path: /var/lib/suricata/rules

rule-files:
  - suricata.rules
  - /etc/suricata/rules/local.rules

# vi /etc/suricata/suricata.yaml

# 1924行目あたりに追記

default-rule-path: /var/lib/suricata/rules

rule-files:

- suricata.rules

- /etc/suricata/rules/local.rules

③設定ファイルのテスト

# suricata -T -c /etc/suricata/suricata.yaml -v
8/1/2023 -- 16:06:55 - <Info> - fast output device (regular) initialized: fast.log
8/1/2023 -- 16:06:55 - <Info> - eve-log output device (regular) initialized: eve.json
8/1/2023 -- 16:06:55 - <Info> - stats output device (regular) initialized: stats.log
8/1/2023 -- 16:07:03 - <Info> - 2 rule files processed. 32474 rules successfully loaded, 0 rules failed
8/1/2023 -- 16:07:03 - <Info> - Threshold config parsed: 0 rule(s) found
8/1/2023 -- 16:07:04 - <Info> - 32477 signatures processed. 1379 are IP-only rules, 5172 are inspecting packet payload, 25723 inspect application layer, 108 are decoder event only
8/1/2023 -- 16:07:17 - <Notice> - Configuration provided was successfully loaded. Exiting.
8/1/2023 -- 16:07:17 - <Info> - cleaning up signature grouping structure... complete

# suricata -T -c /etc/suricata/suricata.yaml -v

8/1/2023 -- 16:06:55 - <Info> - fast output device (regular) initialized: fast.log

8/1/2023 -- 16:06:55 - <Info> - eve-log output device (regular) initialized: eve.json

8/1/2023 -- 16:06:55 - <Info> - stats output device (regular) initialized: stats.log

8/1/2023 -- 16:07:03 - <Info> - 2 rule files processed. 32474 rules successfully loaded, 0 rules failed

8/1/2023 -- 16:07:03 - <Info> - Threshold config parsed: 0 rule(s) found

8/1/2023 -- 16:07:04 - <Info> - 32477 signatures processed. 1379 are IP-only rules, 5172 are inspecting packet payload, 25723 inspect application layer, 108 are decoder event only

8/1/2023 -- 16:07:17 - <Notice> - Configuration provided was successfully loaded. Exiting.

8/1/2023 -- 16:07:17 - <Info> - cleaning up signature grouping structure... complete

Suricat service再起動

# systemctl restart suricata

1	# systemctl restart suricata

④Custom Rulesの適用テスト
同一ローカルネットワーク上の別のデバイスでpingを実行し、ログに記録されたかどうかを確認する

# cat /var/log/suricata/fast.log

01/08/2023-16:08:17.050500  [**] [1:1:1] ICMP Ping [**] [Classification: (null)] [Priority: 3] {ICMP} 192.168.11.22:8 -> 192.168.11.83:0
01/08/2023-16:08:17.050564  [**] [1:1:1] ICMP Ping [**] [Classification: (null)] [Priority: 3] {ICMP} 192.168.11.83:0 -> 192.168.11.22:0

# cat /var/log/suricata/fast.log

01/08/2023-16:08:17.050500 [**] [1:1:1] ICMP Ping [**] [Classification: (null)] [Priority: 3] {ICMP} 192.168.11.22:8 -> 192.168.11.83:0

01/08/2023-16:08:17.050564 [**] [1:1:1] ICMP Ping [**] [Classification: (null)] [Priority: 3] {ICMP} 192.168.11.83:0 -> 192.168.11.22:0

JSON形式のログを取得するには、システムにjqをインストールする

# dnf install jq

1	# dnf install jq

# systemctl restart suricata

1	# systemctl restart suricata

下記コマンドを実行し、同一ローカルネットワーク上の別のデバイスでpingを実行する

# tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert")'
pingを実行するとコンソールに下記のように表示される
{
  "timestamp": "2023-01-08T16:10:25.334104+0900",
  "flow_id": 849355223406872,
  "in_iface": "ens33",
  "event_type": "alert",
  "src_ip": "192.168.11.22",
  "src_port": 0,
  "dest_ip": "192.168.11.83",
  "dest_port": 0,
  "proto": "ICMP",
  "icmp_type": 8,
  "icmp_code": 0,
  "alert": {
    "action": "allowed",
    "gid": 1,
    "signature_id": 1,
    "rev": 1,
    "signature": "ICMP Ping",
    "category": "",
    "severity": 3
  },
  "flow": {
    "pkts_toserver": 1,
    "pkts_toclient": 0,
    "bytes_toserver": 74,
    "bytes_toclient": 0,
    "start": "2023-01-08T16:10:25.334104+0900"
  }
}

# tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert")'

pingを実行するとコンソールに下記のように表示される

{

"timestamp": "2023-01-08T16:10:25.334104+0900",

"flow_id": 849355223406872,

"in_iface": "ens33",

"event_type": "alert",

"src_ip": "192.168.11.22",

"src_port": 0,

"dest_ip": "192.168.11.83",

"dest_port": 0,

"proto": "ICMP",

"icmp_type": 8,

"icmp_code": 0,

"alert": {

"action": "allowed",

"gid": 1,

"signature_id": 1,

"rev": 1,

"signature": "ICMP Ping",

"category": "",

"severity": 3

"flow": {

"pkts_toserver": 1,

"pkts_toclient": 0,

"bytes_toserver": 74,

"bytes_toclient": 0,

"start": "2023-01-08T16:10:25.334104+0900"

}

Tripwire インストール

1.ダウンロード、インストール

# cd /usr/local/src
# wget https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/t/tripwire-2.4.3.7-13.el9.x86_64.rpm
# rpm -Uvh tripwire-2.4.3.7-13.el9.x86_64.rpm

# cd /usr/local/src

# wget https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/t/tripwire-2.4.3.7-13.el9.x86_64.rpm

# rpm -Uvh tripwire-2.4.3.7-13.el9.x86_64.rpm

2.パスフレーズ設定

サイトパスフレーズとローカルパスフレーズを設定する

# tripwire-setup-keyfiles

1	# tripwire-setup-keyfiles

----------------------------------------------
The Tripwire site and local passphrases are used to sign a variety of
files, such as the configuration, policy, and database files.
Passphrases should be at least 8 characters in length and contain both
letters and numbers.
See the Tripwire manual for more information.
----------------------------------------------
Creating key files...
(When selecting a passphrase, keep in mind that good passphrases typically
have upper and lower case letters, digits and punctuation marks, and are
at least 8 characters in length.)
Enter the site keyfile passphrase: ←任意の「サイトパスフレーズ」を入力
Verify the site keyfile passphrase: ←再度「サイトパスフレーズ」を入力
Generating key (this may take several minutes)...Key generation complete.
(When selecting a passphrase, keep in mind that good passphrases typically
have upper and lower case letters, digits and punctuation marks, and are
at least 8 characters in length.)
Enter the local keyfile passphrase: ←任意の「ローカルパスフレーズ」を入力
Verify the local keyfile passphrase: ←再度「ローカルパスフレーズ」を入力
Generating key (this may take several minutes)...Key generation complete.
----------------------------------------------
Signing configuration file...
Please enter your site passphrase: ←「サイトパスフレーズ」を入力
Wrote configuration file: /etc/tripwire/tw.cfg
A clear-text version of the Tripwire configuration file:
/etc/tripwire/twcfg.txt
has been preserved for your inspection. It is recommended that you
move this file to a secure location and/or encrypt it in place (using a
tool such as GPG, for example) after you have examined it.
----------------------------------------------
Signing policy file...
Please enter your site passphrase: ←「サイトパスフレーズ」を入力
Wrote policy file: /etc/tripwire/tw.pol
A clear-text version of the Tripwire policy file:
/etc/tripwire/twpol.txt
～中略～
default values from the current configuration file are used.

----------------------------------------------

The Tripwire site and local passphrases are used to sign a variety of

files, such as the configuration, policy, and database files.

Passphrases should be at least 8 characters in length and contain both

letters and numbers.

See the Tripwire manual for more information.

----------------------------------------------

Creating key files...

(When selecting a passphrase, keep in mind that good passphrases typically

have upper and lower case letters, digits and punctuation marks, and are

at least 8 characters in length.)

Enter the site keyfile passphrase: ←任意の「サイトパスフレーズ」を入力

Verify the site keyfile passphrase: ←再度「サイトパスフレーズ」を入力

Generating key (this may take several minutes)...Key generation complete.

(When selecting a passphrase, keep in mind that good passphrases typically

have upper and lower case letters, digits and punctuation marks, and are

at least 8 characters in length.)

Enter the local keyfile passphrase: ←任意の「ローカルパスフレーズ」を入力

Verify the local keyfile passphrase: ←再度「ローカルパスフレーズ」を入力

Generating key (this may take several minutes)...Key generation complete.

----------------------------------------------

Signing configuration file...

Please enter your site passphrase: ←「サイトパスフレーズ」を入力

Wrote configuration file: /etc/tripwire/tw.cfg

A clear-text version of the Tripwire configuration file:

/etc/tripwire/twcfg.txt

has been preserved for your inspection. It is recommended that you

move this file to a secure location and/or encrypt it in place (using a

tool such as GPG, for example) after you have examined it.

----------------------------------------------

Signing policy file...

Please enter your site passphrase: ←「サイトパスフレーズ」を入力

Wrote policy file: /etc/tripwire/tw.pol

A clear-text version of the Tripwire policy file:

/etc/tripwire/twpol.txt

～中略～

default values from the current configuration file are used.

3.Tripwire の設定

①設定ファイル編集

# vi /etc/tripwire/twcfg.txt
●9 行目あたり
行頭に「#」を追加し、その下の行に「LOOSEDIRECTORYCHECKING =true」を追加します。
●12 行目あたり
行頭に「#」を追加し、その下の行に「REPORTLEVEL =4」を追加します。
レベル4 にすることで「0 」～「4 」までの5 段階中、最も詳細なレポートが表示されます。
#REPORTLEVEL =3
REPORTLEVEL =4

# vi /etc/tripwire/twcfg.txt

●9 行目あたり

行頭に「#」を追加し、その下の行に「LOOSEDIRECTORYCHECKING =true」を追加します。

●12 行目あたり

行頭に「#」を追加し、その下の行に「REPORTLEVEL =4」を追加します。

レベル4 にすることで「0 」～「4 」までの5 段階中、最も詳細なレポートが表示されます。

#REPORTLEVEL =3

REPORTLEVEL =4

②Tripwire 設定ファイル(暗号署名版)を作成

# twadmin -m F -c /etc/tripwire/tw.cfg -S /etc/tripwire/site.key /etc/tripwire/twcfg.txt
Please enter your site passphrase: ←サイトパスフレーズを入力
Wrote configuration file: /etc/tripwire/tw.cfg

# twadmin -m F -c /etc/tripwire/tw.cfg -S /etc/tripwire/site.key /etc/tripwire/twcfg.txt

Please enter your site passphrase: ←サイトパスフレーズを入力

Wrote configuration file: /etc/tripwire/tw.cfg

③Tripwire 設定ファイル(テキスト版)削除

# rm -f /etc/tripwire/twcfg.txt

1	# rm -f /etc/tripwire/twcfg.txt

④ポリシーファイル設定

# cd /etc/tripwire/
# vi twpolmake.pl

1 2	# cd /etc/tripwire/ # vi twpolmake.pl

twpolmake.plの内容

#!/usr/bin/perl
# Tripwire Policy File customize tool
#
$POLFILE=$ARGV[0];

open(POL,"$POLFILE") or die "open error: $POLFILE" ;
my($myhost,$thost) ;
my($sharp,$tpath,$cond) ;
my($INRULE) = 0 ;

while (<POL>) {
chomp;
if (($thost) = /^HOSTNAME\s*=\s*(.*)\s*;/) {
$myhost = `hostname` ; chomp($myhost) ;
if ($thost ne $myhost) {
$_="HOSTNAME=\"$myhost\";" ;
}
}
elsif ( /^{/ ) {
$INRULE=1 ;
}
elsif ( /^}/ ) {
$INRULE=0 ;
}
elsif ($INRULE == 1 and ($sharp,$tpath,$cond) = /^(\s*\#?\s*)(\/\S+)\b(\s+->\s+.+)$/) {
$ret = ($sharp =~ s/\#//g) ;
if ($tpath eq '/sbin/e2fsadm' ) {
$cond =~ s/;\s+(tune2fs.*)$/; \#$1/ ;
}
if (! -s $tpath) {
$_ = "$sharp#$tpath$cond" if ($ret == 0) ;
}
else {
$_ = "$sharp$tpath$cond" ;
}
}
print "$_\n" ;
}
close(POL) ;

#!/usr/bin/perl

# Tripwire Policy File customize tool

$POLFILE=$ARGV[0];

open(POL,"$POLFILE") or die "open error: $POLFILE" ;

my($myhost,$thost) ;

my($sharp,$tpath,$cond) ;

my($INRULE) = 0 ;

while (<POL>) {

chomp;

if (($thost) = /^HOSTNAME\s*=\s*(.*)\s*;/) {

$myhost = `hostname` ; chomp($myhost) ;

if ($thost ne $myhost) {

$_="HOSTNAME=\"$myhost\";" ;

}

elsif ( /^{/ ) {

$INRULE=1 ;

}

elsif ( /^}/ ) {

$INRULE=0 ;

}

elsif ($INRULE == 1 and ($sharp,$tpath,$cond) = /^(\s*\#?\s*)(\/\S+)\b(\s+->\s+.+)$/) {

$ret = ($sharp =~ s/\#//g) ;

if ($tpath eq '/sbin/e2fsadm' ) {

$cond =~ s/;\s+(tune2fs.*)$/; \#$1/ ;

}

if (! -s $tpath) {

$_ = "$sharp#$tpath$cond" if ($ret == 0) ;

}

else {

$_ = "$sharp$tpath$cond" ;

}

print "$_\n" ;

}

close(POL) ;

⑤ポリシーファイル最適化

# perl /etc/tripwire/twpolmake.pl /etc/tripwire/twpol.txt > /etc/tripwire/twpol.txt.new

1	# perl /etc/tripwire/twpolmake.pl /etc/tripwire/twpol.txt > /etc/tripwire/twpol.txt.new

⑥最適化済ポリシーファイルを元に、ポリシーファイル(暗号署名版)作成

# twadmin -m P -c /etc/tripwire/tw.cfg -p /etc/tripwire/tw.pol -S /etc/tripwire/site.key /etc/tripwire/twpol.txt.new
Please enter your site passphrase: ←サイトパスフレーズを入力
Wrote policy file: /etc/tripwire/tw.pol

# twadmin -m P -c /etc/tripwire/tw.cfg -p /etc/tripwire/tw.pol -S /etc/tripwire/site.key /etc/tripwire/twpol.txt.new

Please enter your site passphrase: ←サイトパスフレーズを入力

Wrote policy file: /etc/tripwire/tw.pol

⑦データベースを作成、動作確認

# tripwire -m i -s -c /etc/tripwire/tw.cfg
Please enter your local passphrase: ←ローカルパスフレーズを入力

1 2	# tripwire -m i -s -c /etc/tripwire/tw.cfg Please enter your local passphrase: ←ローカルパスフレーズを入力

テスト用ファイルを作成
# echo test > /root/test.txt

1 2	テスト用ファイルを作成 # echo test > /root/test.txt

Tripwire の動作確認
# tripwire -m c -s -c /etc/tripwire/tw.cfg
下記のように表示されればOK
Open Source Tripwire(R) 2.4.3.7 Integrity Check Report

Report generated by:          root
Report created on:            Sun 08 Jan 2023 04:18:02 PM JST
Database last updated on:     Never

===============================================================================
Report Summary:
===============================================================================

Host name:                    Lepard
Host IP address:              192.168.11.83
Host ID:                      None
Policy file used:             /etc/tripwire/tw.pol
Configuration file used:      /etc/tripwire/tw.cfg
Database file used:           /var/lib/tripwire/Lepard.twd
Command line used:            tripwire -m c -s -c /etc/tripwire/tw.cfg

===============================================================================
Rule Summary:
===============================================================================

-------------------------------------------------------------------------------
  Section: Unix File System
-------------------------------------------------------------------------------

  Rule Name                       Severity Level    Added    Removed  Modified
  ---------                       --------------    -----    -------  --------
  User binaries                   66                0        0        0
  Tripwire Binaries               100               0        0        0
  Libraries                       66                0        0        0
  Operating System Utilities      100               0        0        0
  File System and Disk Administraton Programs
                                  100               0        0        0
  Kernel Administration Programs  100               0        0        0
  Networking Programs             100               0        0        0
  System Administration Programs  100               0        0        0
  Hardware and Device Control Programs
                                  100               0        0        0
  System Information Programs     100               0        0        0
  (/sbin/runlevel)
  Application Information Programs
                                  100               0        0        0
  (/sbin/rtmon)
  Critical Utility Sym-Links      100               0        0        0
  Shell Binaries                  100               0        0        0
  Critical system boot files      100               0        0        0
* Tripwire Data Files             100               1        0        0
  System boot changes             100               0        0        0
  OS executables and libraries    100               0        0        0
  Security Control                100               0        0        0
  Login Scripts                   100               0        0        0
  Critical configuration files    100               0        0        0
* Root config files               100               1        0        0
  Invariant Directories           66                0        0        0
  Temporary directories           33                0        0        0
  Critical devices                100               0        0        0
  (/proc/kcore)

Total objects scanned:  37836
Total violations found:  2

===============================================================================
Object Summary:
===============================================================================

-------------------------------------------------------------------------------
# Section: Unix File System
-------------------------------------------------------------------------------

-------------------------------------------------------------------------------
Rule Name: Tripwire Data Files (/var/lib/tripwire)
Severity Level: 100
-------------------------------------------------------------------------------

Added:
"/var/lib/tripwire/Lepard.twd"

-------------------------------------------------------------------------------
Rule Name: Root config files (/root)
Severity Level: 100
-------------------------------------------------------------------------------

Added:
"/root/test.txt"

===============================================================================
Error Report:
===============================================================================

No Errors

-------------------------------------------------------------------------------
*** End of report ***

Open Source Tripwire 2.4 Portions copyright 2000-2018 Tripwire, Inc.  Tripwire is a registered
trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;
for details use --version. This is free software which may be redistributed
or modified only under certain conditions; see COPYING for details.
All rights reserved.

100

101

102

103

Tripwire の動作確認

# tripwire -m c -s -c /etc/tripwire/tw.cfg

下記のように表示されればOK

Open Source Tripwire(R) 2.4.3.7 Integrity Check Report

Report generated by: root

Report created on: Sun 08 Jan 2023 04:18:02 PM JST

Database last updated on: Never

===============================================================================

Report Summary:

===============================================================================

Host name: Lepard

Host IP address: 192.168.11.83

Host ID: None

Policy file used: /etc/tripwire/tw.pol

Configuration file used: /etc/tripwire/tw.cfg

Database file used: /var/lib/tripwire/Lepard.twd

Command line used: tripwire -m c -s -c /etc/tripwire/tw.cfg

===============================================================================

Rule Summary:

===============================================================================

-------------------------------------------------------------------------------

Section: Unix File System

-------------------------------------------------------------------------------

Rule Name Severity Level Added Removed Modified

--------- -------------- ----- ------- --------

User binaries 66 0 0 0

Tripwire Binaries 100 0 0 0

Libraries 66 0 0 0

Operating System Utilities 100 0 0 0

File System and Disk Administraton Programs

100 0 0 0

Kernel Administration Programs 100 0 0 0

Networking Programs 100 0 0 0

System Administration Programs 100 0 0 0

Hardware and Device Control Programs

100 0 0 0

System Information Programs 100 0 0 0

(/sbin/runlevel)

Application Information Programs

100 0 0 0

(/sbin/rtmon)

Critical Utility Sym-Links 100 0 0 0

Shell Binaries 100 0 0 0

Critical system boot files 100 0 0 0

* Tripwire Data Files 100 1 0 0

System boot changes 100 0 0 0

OS executables and libraries 100 0 0 0

Security Control 100 0 0 0

Critical configuration files 100 0 0 0

* Root config files 100 1 0 0

Invariant Directories 66 0 0 0

Temporary directories 33 0 0 0

Critical devices 100 0 0 0

(/proc/kcore)

Total objects scanned: 37836

Total violations found: 2

===============================================================================

Object Summary:

===============================================================================

-------------------------------------------------------------------------------

# Section: Unix File System

-------------------------------------------------------------------------------

Rule Name: Tripwire Data Files (/var/lib/tripwire)

Severity Level: 100

-------------------------------------------------------------------------------

Added:

"/var/lib/tripwire/Lepard.twd"

-------------------------------------------------------------------------------

Rule Name: Root config files (/root)

Severity Level: 100

-------------------------------------------------------------------------------

Added:

"/root/test.txt"

===============================================================================

Error Report:

===============================================================================

No Errors

-------------------------------------------------------------------------------

*** End of report ***

trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;

for details use --version. This is free software which may be redistributed

or modified only under certain conditions; see COPYING for details.

テスト用ファイルを削除

# rm -f /root/test.txt

1	# rm -f /root/test.txt

⑧Tripwire 定期実行スクリプト

# cd /var/www/system
# vi tripwire.sh

1 2	# cd /var/www/system # vi tripwire.sh

tripwire.shの内容

#!/bin/bash

PATH=/usr/sbin:/usr/bin:/bin:/usr/local/tripwire/sbin

# パスフレーズ設定
LOCALPASS= ←ローカルパスフレーズ
SITEPASS= 　←サイトパスフレーズ

cd /etc/tripwire

# Tripwireチェック実行
tripwire -m c -s -c tw.cfg|mail -s "Tripwire(R) Integrity Check Report in `hostname`" root

# ポリシーファイル最新化
twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt
perl twpolmake.pl twpol.txt > twpol.txt.new
twadmin -m P -c tw.cfg -p tw.pol -S site.key -Q $SITEPASS twpol.txt.new > /dev/null
rm -f twpol.txt* *.bak

# データベース最新化
rm -f /usr/local/tripwire/lib/tripwire/*.twd*
tripwire -m i -s -c tw.cfg -P $LOCALPASS

#!/bin/bash

PATH=/usr/sbin:/usr/bin:/bin:/usr/local/tripwire/sbin

# パスフレーズ設定

LOCALPASS= ←ローカルパスフレーズ

SITEPASS= 　←サイトパスフレーズ

cd /etc/tripwire

# Tripwireチェック実行

tripwire -m c -s -c tw.cfg|mail -s "Tripwire(R) Integrity Check Report in `hostname`" root

# ポリシーファイル最新化

twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt

perl twpolmake.pl twpol.txt > twpol.txt.new

twadmin -m P -c tw.cfg -p tw.pol -S site.key -Q $SITEPASS twpol.txt.new > /dev/null

rm -f twpol.txt* *.bak

# データベース最新化

rm -f /usr/local/tripwire/lib/tripwire/*.twd*

tripwire -m i -s -c tw.cfg -P $LOCALPASS

⑨Tripwire 自動実行スクリプト実行設定

# chmod 700 tripwire.sh

cron に追加
# crontab -e
0 3 * * * /var/www/system/tripwire.sh

# chmod 700 tripwire.sh

cron に追加

# crontab -e

0 3 * * * /var/www/system/tripwire.sh

参考: メールで結果報告用スクリプト

#!/bin/bash

PATH=/usr/sbin:/usr/bin:/bin:/usr/local/tripwire/sbin

# パスフレーズ設定
LOCALPASS=xxxxx # ローカルキーパスフレーズ
SITEPASS=xxxxx # サイトキーパスフレーズ

#通知先メールアドレス指定
MAIL="<your mailaddress> "

cd /etc/tripwire

# Tripwireチェック実行
tripwire -m c -s -c tw.cfg|mail -s "Tripwire(R) Integrity Check Report in `hostname`" $MAIL

# ポリシーファイル最新化
twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt
perl twpolmake.pl twpol.txt > twpol.txt.new
twadmin -m P -c tw.cfg -p tw.pol -S site.key -Q $SITEPASS twpol.txt.new > /dev/null
rm -f twpol.txt* *.bak

# データベース最新化
rm -f /usr/local/tripwire/lib/tripwire/*.twd*
tripwire -m i -s -c tw.cfg -P $LOCALPASS

#!/bin/bash

PATH=/usr/sbin:/usr/bin:/bin:/usr/local/tripwire/sbin

# パスフレーズ設定

LOCALPASS=xxxxx # ローカルキーパスフレーズ

SITEPASS=xxxxx # サイトキーパスフレーズ

#通知先メールアドレス指定

MAIL="<your mailaddress> "

cd /etc/tripwire

# Tripwireチェック実行

tripwire -m c -s -c tw.cfg|mail -s "Tripwire(R) Integrity Check Report in `hostname`" $MAIL

# ポリシーファイル最新化

twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt

perl twpolmake.pl twpol.txt > twpol.txt.new

twadmin -m P -c tw.cfg -p tw.pol -S site.key -Q $SITEPASS twpol.txt.new > /dev/null

rm -f twpol.txt* *.bak

# データベース最新化

rm -f /usr/local/tripwire/lib/tripwire/*.twd*

tripwire -m i -s -c tw.cfg -P $LOCALPASS

下記コマンドを実行し、指定したメールアドレスにtripwire実行結果が通知されることを確認

# /var/www/system/tripwire.sh

1	# /var/www/system/tripwire.sh

Chkrootkit インストール

①chkrootkit をダウンロード、インストール

# cd /usr/local/src
# wget https://launchpad.net/chkrootkit/main/0.55/+download/chkrootkit-0.55.tar.gz
# tar xvf chkrootkit-0.55.tar.gz

# cd /usr/local/src

# wget https://launchpad.net/chkrootkit/main/0.55/+download/chkrootkit-0.55.tar.gz

# tar xvf chkrootkit-0.55.tar.gz

➁/root/bin ディレクトリを作成し、そのディレクトリにchkrootkit コマンドを移動

# mkdir -p /root/bin
# mv chkrootkit-0.55/chkrootkit /root/bin

1 2	# mkdir -p /root/bin # mv chkrootkit-0.55/chkrootkit /root/bin

➂chkrootkit を確認します。

# chkrootkit | grep INFECTED
何も表示されなければ問題ありません

1 2	# chkrootkit \| grep INFECTED 何も表示されなければ問題ありません

Checking `chsh'... INFECTED

上記の表示が出る場合はおそらく誤検知だと思います。

④chkrootkit 定期実行スクリプトの作成と権限変更

chkrootkit実行スクリプトを毎日自動実行されるディレクトリへ作成
# vi /etc/cron.daily/chkrootkit

1 2	chkrootkit実行スクリプトを毎日自動実行されるディレクトリへ作成 # vi /etc/cron.daily/chkrootkit

定期実行スクリプトの内容

#!/bin/bash

PATH=/usr/bin:/bin:/root/bin

LOG=/tmp/$(basename ${0})

# chkrootkit実行
chkrootkit > $LOG 2>&1

# ログ出力
cat $LOG | logger -t $(basename ${0})

# SMTPSのbindshell誤検知対応
if [ ! -z "$(grep 465 $LOG)" ] && \
[ -z $(/usr/sbin/lsof -i:465|grep bindshell) ]; then
sed -i '/465/d' $LOG
fi

# upstartパッケージ更新時のSuckit誤検知対応
if [ ! -z "$(grep Suckit $LOG)" ] && \
[ -z "$(rpm -V `rpm -qf /sbin/init`)" ]; then
sed -i '/Suckit/d' $LOG
fi

# rootkit検知時のみroot宛メール送信
[ ! -z "$(grep INFECTED $LOG)" ] && \
grep INFECTED $LOG | mail -s "chkrootkit report in `hostname`" root

#!/bin/bash

PATH=/usr/bin:/bin:/root/bin

LOG=/tmp/$(basename ${0})

# chkrootkit実行

chkrootkit > $LOG 2>&1

# ログ出力

cat $LOG | logger -t $(basename ${0})

# SMTPSのbindshell誤検知対応

if [ ! -z "$(grep 465 $LOG)" ] && \

[ -z $(/usr/sbin/lsof -i:465|grep bindshell) ]; then

sed -i '/465/d' $LOG

# upstartパッケージ更新時のSuckit誤検知対応

if [ ! -z "$(grep Suckit $LOG)" ] && \

[ -z "$(rpm -V `rpm -qf /sbin/init`)" ]; then

sed -i '/Suckit/d' $LOG

# rootkit検知時のみroot宛メール送信

[ ! -z "$(grep INFECTED $LOG)" ] && \

grep INFECTED $LOG | mail -s "chkrootkit report in `hostname`" root

chkrootkit実行スクリプトへ実行権限付加

# chmod 700 /etc/cron.daily/chkrootkit

1	# chmod 700 /etc/cron.daily/chkrootkit

⑥chkrootkit が使用するコマンドをバックアップ

chkrootkit が使用するコマンドが改ざんされた場合、rootkit を検出できなくなるので、
これらのコマンドをバックアップしておきます。
必要な場合は、バックアップしたコマンドを使用してchkrootkit を実行します

# cd /root
# mkdir /root/chkrootkit_cmd
# cp `which --skip-alias awk cut echo egrep find head id ls netstat ps strings sed ssh uname` chkrootkit_cmd/
# ls -l /root/chkrootkit_cmd/
total 2640
-rwxr-xr-x 1 root root 714968 Jan  8 16:28 awk
-rwxr-xr-x 1 root root  49912 Jan  8 16:28 cut
-rwxr-xr-x 1 root root  37288 Jan  8 16:28 echo
-rwxr-xr-x 1 root root     32 Jan  8 16:28 egrep
-rwxr-xr-x 1 root root 292760 Jan  8 16:28 find
-rwxr-xr-x 1 root root  45552 Jan  8 16:28 head
-rwxr-xr-x 1 root root  41616 Jan  8 16:28 id
-rwxr-xr-x 1 root root 142168 Jan  8 16:28 ls
-rwxr-xr-x 1 root root 161624 Jan  8 16:28 netstat
-rwxr-xr-x 1 root root 144448 Jan  8 16:28 ps
-rwxr-xr-x 1 root root 116736 Jan  8 16:28 sed
-rwxr-xr-x 1 root root 851232 Jan  8 16:28 ssh
-rwxr-xr-x 1 root root  33176 Jan  8 16:28 strings
-rwxr-xr-x 1 root root  33376 Jan  8 16:28 uname

# cd /root

# mkdir /root/chkrootkit_cmd

# cp `which --skip-alias awk cut echo egrep find head id ls netstat ps strings sed ssh uname` chkrootkit_cmd/

# ls -l /root/chkrootkit_cmd/

total 2640

-rwxr-xr-x 1 root root 714968 Jan 8 16:28 awk

-rwxr-xr-x 1 root root 49912 Jan 8 16:28 cut

-rwxr-xr-x 1 root root 37288 Jan 8 16:28 echo

-rwxr-xr-x 1 root root 32 Jan 8 16:28 egrep

-rwxr-xr-x 1 root root 292760 Jan 8 16:28 find

-rwxr-xr-x 1 root root 45552 Jan 8 16:28 head

-rwxr-xr-x 1 root root 41616 Jan 8 16:28 id

-rwxr-xr-x 1 root root 142168 Jan 8 16:28 ls

-rwxr-xr-x 1 root root 161624 Jan 8 16:28 netstat

-rwxr-xr-x 1 root root 144448 Jan 8 16:28 ps

-rwxr-xr-x 1 root root 116736 Jan 8 16:28 sed

-rwxr-xr-x 1 root root 851232 Jan 8 16:28 ssh

-rwxr-xr-x 1 root root 33176 Jan 8 16:28 strings

-rwxr-xr-x 1 root root 33376 Jan 8 16:28 uname

⑦コピーしたコマンドにchkrootkit を実行

# chkrootkit -p /root/chkrootkit_cmd | grep INFECTED

1	# chkrootkit -p /root/chkrootkit_cmd \| grep INFECTED

何も表示されなければ問題ありません

⑧バックアップしたコマンドを圧縮

# tar zcvf chkrootkit_cmd.tar.gz chkrootkit_cmd
chkrootkit_cmd/
chkrootkit_cmd/awk
chkrootkit_cmd/cut
chkrootkit_cmd/echo
chkrootkit_cmd/egrep
chkrootkit_cmd/find
chkrootkit_cmd/head
chkrootkit_cmd/id
chkrootkit_cmd/ls
chkrootkit_cmd/netstat
chkrootkit_cmd/ps
chkrootkit_cmd/strings
chkrootkit_cmd/sed
chkrootkit_cmd/ssh
chkrootkit_cmd/uname

# tar zcvf chkrootkit_cmd.tar.gz chkrootkit_cmd

chkrootkit_cmd/

chkrootkit_cmd/awk

chkrootkit_cmd/cut

chkrootkit_cmd/echo

chkrootkit_cmd/egrep

chkrootkit_cmd/find

chkrootkit_cmd/head

chkrootkit_cmd/id

chkrootkit_cmd/ls

chkrootkit_cmd/netstat

chkrootkit_cmd/ps

chkrootkit_cmd/strings

chkrootkit_cmd/sed

chkrootkit_cmd/ssh

chkrootkit_cmd/uname

# ls -l
total 1200
-rw-------. 1 root root    1196 Jan  6 17:40 anaconda-ks.cfg
drwxr-xr-x  2 root root      24 Jan  8 16:27 bin
drwxr-xr-x  2 root root     172 Jan  8 16:28 chkrootkit_cmd
-rw-r--r--  1 root root 1223162 Jan  8 16:29 chkrootkit_cmd.tar.gz
drwx------  3 root root      21 Jan  8 13:58 snap

# ls -l

total 1200

-rw-------. 1 root root 1196 Jan 6 17:40 anaconda-ks.cfg

drwxr-xr-x 2 root root 24 Jan 8 16:27 bin

drwxr-xr-x 2 root root 172 Jan 8 16:28 chkrootkit_cmd

-rw-r--r-- 1 root root 1223162 Jan 8 16:29 chkrootkit_cmd.tar.gz

drwx------ 3 root root 21 Jan 8 13:58 snap

⑨chkrootkit使用コマンド(圧縮版)をroot宛にメール送信

# echo|mail -a chkrootkit_cmd.tar.gz -s chkrootkit_cmd.tar.gz root

1	# echo\|mail -a chkrootkit_cmd.tar.gz -s chkrootkit_cmd.tar.gz root

⑩Windows にchkrootkit_cmd.tar.gz ファイルをダウンロードして退避

⑪バックアップしたサーバー上のコマンドを削除

# rm -f chkrootkit_cmd.tar.gz

1	# rm -f chkrootkit_cmd.tar.gz

ページのトップへ