http://www.rfxn.com/projects/linux-malware-detect/
http://www.rfxn.com/appdocs/README.maldetect
http://www.rfxn.com/appdocs/CHANGELOG.maldetect
Overview
Linux Malware Detect (LMD) uses MD5 file hashes and hex pattern matches to identify malware. The goal of LMD is to provide a threat detection, alerting and quarantine tool for Linux web servers, though the MD5/hex signatures are portable to any number of detection tools. There is currently limited availability of open source, restriction free, tools for Linux systems that focus on malware detection and more important that get it right. Many of the AV products that perform malware detection on Linux have a very poor track record of detecting threats, especially those targeted at shared web hosting servers. The threat landscape on shared web hosting servers is unique from that of the standard AV products detection suite in that they are detecting primarily trojans / rootkit content but missing the ever increasing malware on the account level which serves as an attack platform. Using the cymru.com malware hash repository, which provides malware data for Microsoft, Google, Trend Micro, F-Secure, Symantec and more; we can demonstrate this short coming in current threat detection.
Features
* MD5 file hash detection for quick threat identification
* HEX based pattern matching for identifying threat variants
* integrated signature update feature, executes through cron.daily and –update
* integrated version update feature with –update-ver, must run manual
* scan-recent option to scan only files that have been added/changed in X days
* scan-all option for full path based scanning
* checkout option to upload suspected malware to rfxn.com for review / hashing
* report option to view past or recent scan results
* quarantine queue that stores threats in a safe fashion with no permissions
* quarantine batching option to quarantine the results of a past or recent scan
* quarantine restore option to restore files to original path, owner and perms
* quarantine suspend account option to Cpanel suspend or shell revoke users
* cleaner rules to attempt removal of malware injected strings
* cleaner batching option to attempt cleaning of previous scan reports
* cleaner rules to remove base64 and gzinflate(base64 injected malware
* daily cron based scanning of all changes in last 24h in user homedirs
* daily cron script compatible with stock RH style systems, Cpanel & Ensim
* kernel based inotify real time file scanning of created/modified/moved files
* kernel inotify monitor that can take path data from STDIN or FILE
* kernel inotify monitor convenience feature to monitor system users
* kernel inotify monitor can be restricted to a configurable user html root
* kernel inotify monitor with dynamic sysctl limits for optimal performance
* kernel inotify alerting through daily and/or optional weekly reports
* e-mail alert reporting after every scan execution (manual & daily)
* path and signature based ignore options
* verbose logging & output of all actions
Installation
cd /usr/local/src/
rm -vrf maldetect-*
wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
tar -xzf maldetect-current.tar.gz
cd maldetect-*
sh ./install.sh
maldet --update-ver
maldet --update
Post-installation Notes
Upon installing maldet, it creates /etc/cron.daily/maldet, which will:
* Check for new definitions
* Send daily inotify alerts to $email_addr
* Scan for file changes over the last 2 days on /home?/?/public_html (? being wildcard) if inotify isn't running
You may want to consider activating the inotify monitor by executing the following command:
maldet --monitor users
You may also want to consider activating the many features of maldet, for example:
email_alert=1
email_addr="root"
quar_hits=1
scanthreads=5
maxfilesize="1024k"
To edit these options, $EDITOR /usr/local/maldetect/conf.maldet
Syntax
[CODE]-u, --update
Update malware detection signatures from rfxn.com
-d, --update-ver
Update the installed version from rfxn.com
-m, --monitor USERS|PATHS|FILE
Run maldet with inotify kernel level file create/modify monitoring
If USERS is specified, monitor user homedirs for UID's > 500
If FILE is specified, paths will be extracted from file, line spaced
If PATHS are specified, must be comma spaced list, NO WILDCARDS!
e.g: maldet --monitor users
e.g: maldet --monitor /root/monitor_paths
e.g: maldet --monitor /home/mike,/home/ashton
-k, --kill
Terminate inotify monitoring service
-r, --scan-recent PATH DAYS
Scan files created/modified in the last X days (default: 7d, wildcard: ?)
e.g: maldet -r /home/?/public_html 2
-a, --scan-all PATH
Scan all files in path (default: /home, wildcard: ?)
e.g: maldet -a /home/?/public_html
-c, --checkout FILE
Upload suspected malware to rfxn.com for review & hashing into signatures
-l, --log
View maldet log file events
-e, --report SCANID
View scan report of the most recent scan or provided SCANID
e.g: maldet --report
e.g: maldet --report 050910-1534.21135
-s, --restore FILE
Restore file from quarantine queue to orginal path
e.g: maldet --restore /usr/local/maldetect/quarantine/config.php.23754
-q, --quarantine SCANID
Quarantine all malware from report SCANID
e.g: maldet --quarantine 050910-1534.21135
-n, --clean SCANID
Try to clean & restore malware hits from report SCANID
e.g: maldet --clean 050910-1534.21135
-p, --purge
Clear logs, quarantine queue, session and temporary data.[CODE]
Common Tasks
Scanning all users public_html
maldet -a /home?/?/public_html
scan for specific user
maldet --scan-all /home?/USER/public_html
