Free Linux Security Tools

[fwh-Robert]

As a Linux system administrator it's often difficult to monitor the machine constantly for any signs of tampering. We've put together a simple, easy-to-use script for you to help maintain and monitor your server from any rootkit hijack attempts and to notify you, the system administrator of any potential issues.

The free shell executable file contains the following features:

• E-mail alerts sent on root login
• Installs the latest version of RootKitHunter and sets up daily cron task for notifications
• Installs the latest version of CHKRootkit and sets up daily cron task for notifications

How to use

Please note - we [Freewind Services Ltd] accept no responsibility or liability for any issues/damage that is caused to your system through the use of, or execution of this script.

Download the attached file (harden.zip) and extract using unzip.

Run the following commands as root:

chmod +x harden.sh

Replace any instances of you@yourdomain.com with your e-mail address:

nano harden.sh

Press CTRL + X and then CTRL + Y to save changes. Now execute the script:

./harden.sh

Code
Below is the code executed from the shell executable. Please feel free to modify to your requirements.

#!/bin/sh
(
    # E-mail alert on root login - thanks to WebHostGear (http://www.webhostgear.com/43.html)
    echo "echo 'ALERT - Root Shell Access (${HOSTNAME}) on:' \`date\` \`who\` | mail -s \"Alert: Root Access from \`who | cut -d\"(\" -f2 | cut -d\")\" -f1\`\" you@yourdomain.com" >> /root/.bashrc
    
    # Installs the latest version of RKHunter and sets up daily cron task for notifications
    cd /usr/local/src
    wget http://nchc.dl.sourceforge.net/project/rkhunter/rkhunter/1.3.6/rkhunter-1.3.6.tar.gz
    tar xfz rkhunter-1.3.6.tar.gz
    cd rkhunter-1.3.6
    ./installer.sh --layout default --install
    rkhunter --update -q
    rkhunter --propupd -q
    
    echo -e "#!/bin/bash\n/usr/local/bin/rkhunter --versioncheck -q\n/usr/local/bin/rkhunter --update -q\n/usr/local/bin/rkhunter --cronjob --report-warnings-only | mail -s \"Daily Rkhunter Scan Report from ${HOSTNAME}\" you@yourdomain.com" > /etc/cron.daily/rkhunter.sh
    chmod +x /etc/cron.daily/rkhunter.sh
    
    # Installs latest version of CHKRootkit (http://www.chkrootkit.org/) and sets up daily cron task for notifications
    cd /usr/local/src
    wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz
    tar xfz chkrootkit.tar.gz
    cd chkrootkit*
    make sense
    ./chkrootkit

    echo -e "#!/bin/bash\ncd /usr/local/src/chkrootkit-*/\n./chkrootkit | mail -s \"Daily chkrootkit from ${HOSTNAME}\" you@yourdomain.com" > /etc/cron.daily/chkrootkit.sh
    chmod +x /etc/cron.daily/chkrootkit.sh
)