How to Install Chkrootkit on Fedora 40/39/38 Linux

This guide will demonstrate how to install Chkrootkit on Fedora Linux using two methods: first, through the default Fedora appstream, and second, for those seeking the latest version, by downloading, compiling, and installing the source binary.

Chkrootkit stands out as a trusted tool in the world of server security, particularly acclaimed for its efficiency in detecting rootkits. Rootkits, a form of malicious software often undetectable by standard antivirus programs, pose a significant threat to server environments. Chkrootkit addresses this challenge by offering a suite of features tailored for users, system administrators, and developers. Its primary function is to scrutinize system binaries for signs of rootkit infection.

Here are some key features of Chkrootkit:

• Rootkit Detection: Employs comprehensive scans to detect common rootkits.
• Server Security Monitoring: Regularly checks server systems to ensure they are free of rootkits.
• Lightweight and Efficient: Designed for minimal resource usage, making it ideal for continuous monitoring.
• Compatibility with Various Linux Distributions: Though this guide focuses on Fedora, Chkrootkit is versatile across different Linux environments.
• Ease of Use for Administrators: Straightforward command-line interface that simplifies security checks.
• Open Source: Offers transparency and the opportunity for community-driven improvements and updates.

Understanding Chkrootkit’s capabilities is essential, particularly for those responsible for maintaining the security and integrity of server environments. Let’s move on to the technical details of installing Chkrootkit on Fedora Linux, ensuring your systems stay safeguarded against rootkit threats.

Install Chkrootkit on Fedora Linux Using DNF

Update Package Lists Before Chkrootkit Installation

Before initiating the installation of Chkrootkit on Fedora Linux, it’s crucial to update the system’s package lists. This action ensures your system is aware of all available packages and their latest versions.

To update your Fedora system, execute the following command in the terminal:

sudo dnf upgrade --refresh

Executing this command updates the package database and upgrades installed packages to their most recent versions. This step is vital for maintaining system integrity and security.

Install Chkrootkit Using DNF Command

After updating the system, you can proceed to install Chkrootkit using Fedora’s package manager, DNF. DNF, a robust and efficient tool for software management in Fedora, simplifies the installation process.

Run this command to install Chkrootkit:

sudo dnf install chkrootkit

Verify the Chkrootkit Installation

Post-installation, it’s critical to verify that Chkrootkit has been properly installed on your Fedora system. Ensuring its correct installation guarantees that the software is operational and prepared for use.

To verify Chkrootkit’s installation, execute its version check command:

chkrootkit -V

This command displays the installed version of Chkrootkit, confirming the successful installation and readiness of the tool for system security checks.

Install Chkrootkit on Fedora Linux via Source

Download Chkrootkit Source Code

Begin by downloading the Chkrootkit source code directly from the official site. This step ensures access to the latest version. Open a terminal and navigate to the desired download directory.

Execute the following command to start the download:

wget ftp://chkrootkit.org/pub/seg/pac/chkrootkit.tar.gz

This command retrieves the Chkrootkit source code archive to your specified directory.

Extract Chkrootkit Source Archive

Now, extract the downloaded source code. This extraction is vital for accessing the files needed for the next steps. Use this command to extract the source code:

tar -xvzf chkrootkit.tar.gz

Compile and Install Chkrootkit

Ensure your Fedora system has essential packages like the GNU Compiler Collection (GCC) and make utility. Verify or install these packages with the command:

sudo dnf install gcc make glibc-static
sudo dnf groupinstall "Development Tools"

Navigate to the Chkrootkit source directory, then compile and install Chkrootkit using:

cd chkrootkit-{your-version-number}
make sense

This command compiles Chkrootkit source code, creating an executable file.

Verify Chkrootkit Installation

Confirm Chkrootkit’s successful installation by checking its version. Run:

./chkrootkit -V

Setting Up Chkrootkit for Global Accessibility

Organize Chkrootkit on your Fedora system for global use, adhering to Linux file system structures.

Positioning Chkrootkit in a Standard Directory

Move the Chkrootkit directory to a standardized location for better organization and accessibility. Typically, software like this resides in /usr/local/bin. First, move Chkrootkit to /usr/local/share:

Ensure you’re in the parent directory of Chkrootkit. Execute this command to move the directory:

sudo mv chkrootkit-{your-version-number} /usr/local/share/chkrootkit

This command moves Chkrootkit to /usr/local/share, a common location for shared data.

Creating a Symbolic Link for Easy Access on Fedora

Create a symbolic link in /usr/local/bin for easy Chkrootkit access. This link acts as a shortcut, allowing you to run Chkrootkit from any location in the terminal.

Execute the following to create the symbolic link:

sudo ln -s /usr/local/share/chkrootkit/chkrootkit /usr/local/bin/chkrootkit

Verifying Chkrootkit’s Accessibility on Fedora

Test Chkrootkit’s global accessibility. Run the version check command:

chkrootkit -V

A version output confirms Chkrootkit’s successful setup.

Basic Commands with Chkrootkit on Fedora Linux

Run a Scan for Rootkits with Chkrootkit on Fedora

After installing Chkrootkit on your Fedora system, initiate a rootkit scan. Open your terminal and enter the following command:

sudo chkrootkit

This command triggers a detailed scan, identifying any potential rootkits on your system.

For a more streamlined output highlighting only possible threats, opt for the quiet mode:

sudo chkrootkit -q

Configure Automatic Scanning with Chkrootkit on Fedora

Create a Bash Script for Scanning:

First, you’ll need to create a script that runs Chkrootkit. Open a text editor and write the following script:

#!/bin/bash
/path/to/chkrootkit > /var/log/chkrootkit.log

Replace /path/to/chkrootkit with the actual path to your Chkrootkit executable. Save this script in a suitable location, such as /usr/local/bin/chkrootkit_scan.sh.

Make the Script Executable

sudo chmod +x /usr/local/bin/chkrootkit_scan.sh

Save your changes (CTRL+O) and exit (CTRL+X).

Create a Cron Job for Daily Scans:

Cron jobs are used to schedule tasks at regular intervals. Use the crontab command to edit the cron jobs:

sudo crontab -e

Add the following line to schedule the script to run daily (you can adjust the time as needed):

0 2 * * * /usr/local/bin/chkrootkit_scan.sh

This schedules the scan to run every day at 2:00 AM. The output will be saved in /var/log/chkrootkit.log.

Check if the Cron Service is Running:

sudo systemctl status crond.service

If it’s not running, start it with:

sudo systemctl enable crond.service --now

Testing the Script:

To ensure that everything is set up correctly, you can run the script manually:

/usr/local/bin/chkrootkit_scan.sh

Then check the log file:

cat /var/log/chkrootkit.log

Explore Chkrootkit Commands and Documentation

To familiarize yourself with Chkrootkit’s functionalities, access its Help menu:

chkrootkit -h

Alternatively, delve into the manual pages for comprehensive information:

man chkrootkit

Conclusion

In this guide, we’ve walked through the steps to install and use Chkrootkit on Fedora Linux, covering everything from downloading and compiling to setting up regular scans for enhanced security. By now, you should feel more confident in safeguarding your system against rootkits. Remember, regular scanning is key to maintaining security, and Chkrootkit’s automation feature is a great ally in this ongoing task. Keep exploring its commands and documentation for deeper insights. Stay vigilant and keep your system secure!