Skip to content

Instantly share code, notes, and snippets.

@amekusa

amekusa/rkhunter-propupd.hook

Last active October 21, 2022 03:10
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save amekusa/1b28d1695f67320342e84aef7d5c11b6 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save amekusa/1b28d1695f67320342e84aef7d5c11b6 to your computer and use it in GitHub Desktop.
Download ZIP
Rkhunter Setup
Raw
rkhunter-propupd.hook
# dir: /etc/pacman.d/hooks/
[Trigger]
Operation = Upgrade
Type = Package
Target = *
[Action]
Description = rkhunter --propupd
When = PostTransaction
Exec = /usr/bin/rkhunter --propupd --report-warnings-only
Depends = rkhunter
Raw
rkhunter-status.hook
# dir: /etc/pacman.d/hooks/
[Trigger]
Operation = Upgrade
Type = Package
Target = *
[Action]
Description = rkhunter.service status check
When = PreTransaction
Exec = /usr/bin/sh -c "! /usr/bin/systemctl is-failed rkhunter.service"
Depends = rkhunter
AbortOnFail = yes
Raw
rkhunter.conf.local
# Rootkit Hunter Custom Settings
## Allow some hidden directories/files
ALLOWHIDDENDIR=/etc/.git
ALLOWHIDDENFILE=/etc/.etckeeper
ALLOWHIDDENFILE=/etc/.gitignore
ALLOWHIDDENFILE=/etc/.updated
ALLOWHIDDENFILE=/usr/share/man/man5/.k5identity.5.gz
ALLOWHIDDENFILE=/usr/share/man/man5/.k5login.5.gz
## Ignore the warnings: 'The command ... has been replaced by ...'
SCRIPTWHITELIST=/usr/bin/egrep
SCRIPTWHITELIST=/usr/bin/fgrep
SCRIPTWHITELIST=/usr/bin/ldd
## False Positive: WP-CLI
RTKT_FILE_WHITELIST=/usr/bin/wp
Raw
rkhunter.service
[Unit]
Description=Rootkit Scan
[Service]
Type=oneshot
ExecStartPre=/usr/bin/rkhunter --update --report-warnings-only
ExecStart=/usr/bin/rkhunter --cronjob --report-warnings-only
ExecStartPost=/usr/bin/rkhunter --propupd --report-warnings-only
Raw
rkhunter.timer
[Unit]
Description=Daily Rootkit Scan
[Timer]
OnCalendar=05:00:00
Persistent=true
[Install]
WantedBy=timers.target
@amekusa
Copy link
Author

amekusa commented Jul 25, 2017 •
edited
Loading

Rkhunter Custom Settings

Place rkhunter.conf.local on /etc

Scan Automatically at 5:00 AM Everyday

  1. Place rkhunter.service, rkhunter.timer on /etc/systemd/system
  2. Enable and start rkhunter.timer via systemctl
$ sudo systemctl enable rkhunter.timer
$ sudo systemctl start rkhunter.timer

@amekusa
Copy link
Author

amekusa commented Nov 2, 2021

UPDATE @ 2021-11-03: rkhunter.service

@amekusa
Copy link
Author

amekusa commented Nov 9, 2021

UPDATE @ 2021-11-09
Added rkhunter-propupd.hook

@amekusa
Copy link
Author

amekusa commented Oct 21, 2022

I made a setup script for Arch Linux that can entirely automate this rkhunter setup:
https://github.com/amekusa/arch-setup/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment