Home Operation and Maintenance Linux Operation and Maintenance How to install a Linux malware detection program

How to install a Linux malware detection program

Mar 23, 2019 pm 03:47 PM
linux

Malware is known as malware, it can be any script, application or anything harmful to our system and data.

How to install a Linux malware detection program

Linux Malware detect (LMD) is a malware scanner for Linux, released under the GNU GPLV2 license and designed to address threats faced in hosted environments . It uses threat data from network edge intrusion detection systems to extract malware actively used in attacks and generate signatures for detection.

Threats in shared hosting environments are unique from standard AV product detection suites in that they focus on detecting operating system-level Trojans, rootkits, and traditional virus-infected files, but ignore ongoing threats at the user account level. Increased variety of malware as an attack platform.

Step 1: Download and install LMD

First log in to the server using an ssh client (e.g. putty), then use the following command to download the latest lmd source code.

#cd / opt 
#wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
Copy after login

Now extract the downloaded archive in the current directory

Now extract the downloaded archive file in the current directory

#tar xfz maldetect-current.tar.gz
Copy after login

After decompressing the archive file, execute the install provided in the source .sh script that will install LMD in your system.

#cd maldetect-1.4.2 
#sh install.sh
Copy after login

Step 2: Configure LMD

LMD creates a configuration file /usr/local/maldetect/conf.maldet, where we can define the work and requirements of LMD Action taken.

#vim /usr/local/maldetect/conf.maldet
Copy after login
# [ EMAIL ALERTS ]
##
# The default email alert toggle
# [0 = disabled, 1 = enabled]
email_alert=1

# The subject line for email alerts
email_subj="MLD Scan Report from $(hostname)"

# The destination addresses for email alerts
# [ values are comma (,) spaced ]
email_addr="webmaster@mydomain.com"

# Ignore e-mail alerts for reports in which all hits have been cleaned.
# This is ideal on very busy servers where cleaned hits can drown out
# other more actionable reports.
email_ignore_clean=0

##
# [ QUARANTINE OPTIONS ]
##
# The default quarantine action for malware hits
# [0 = alert only, 1 = move to quarantine & alert]
quar_hits=1

# Try to clean string based malware injections
# [NOTE: quar_hits=1 required]
# [0 = disabled, 1 = clean]
quar_clean=1

# The default suspend action for users wih hits
# Cpanel suspend or set shell /bin/false on non-Cpanel
# [NOTE: quar_hits=1 required]
# [0 = disabled, 1 = suspend account]
quar_susp=0

# minimum userid that can be suspended
quar_susp_minuid=500
Copy after login

Step 3: Start scanning manually

At this stage, LMD has been successfully installed and configured on the system. Let us run the first scan manually by executing the following command.

#maldet --scan-all / var / www / html
Copy after login

The above command will scan all files and directories under /var/www/html. Depending on the number of files, it may take a long time to complete. After completing the above command, it will display a command to view the report as shown below

#maldet --report 060214-1946.24560
Copy after login
malware detect scan report for svr1.tecadmin.net:
SCAN ID: 060214-1946.24560
TIME: May  28 19:46:12 +0530
PATH: /var/www/html/
TOTAL FILES: 4441
TOTAL HITS: 0
TOTAL CLEANED: 0

===============================================
Linux Malware Detect v1.4.2 < proj@rfxn.com >
Copy after login

In this example, TOTAL HITS is 0, so LMD will not detect any malware on the system. But if it detects any malware on the system, the malware can be quarantined using one of the following commands

# maldet --quarantine SCANID
OR
# maldet --clean SCANID
Copy after login

The SCANID can be found in the report generated above.

Step 4: Set up periodic scans

During the installation of LMD, it has created crontab files that are executed daily.

#vi /etc/cron.daily/maldet
Copy after login

However, if your system has a large number of files and directories, you can change the scan to weekly instead of daily.

This article has ended here. For more other exciting content, you can pay attention to the Linux Video Tutorial column on the PHP Chinese website!

The above is the detailed content of How to install a Linux malware detection program. For more information, please follow other related articles on the PHP Chinese website!

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

What computer configuration is required for vscode What computer configuration is required for vscode Apr 15, 2025 pm 09:48 PM

VS Code system requirements: Operating system: Windows 10 and above, macOS 10.12 and above, Linux distribution processor: minimum 1.6 GHz, recommended 2.0 GHz and above memory: minimum 512 MB, recommended 4 GB and above storage space: minimum 250 MB, recommended 1 GB and above other requirements: stable network connection, Xorg/Wayland (Linux)

vscode cannot install extension vscode cannot install extension Apr 15, 2025 pm 07:18 PM

The reasons for the installation of VS Code extensions may be: network instability, insufficient permissions, system compatibility issues, VS Code version is too old, antivirus software or firewall interference. By checking network connections, permissions, log files, updating VS Code, disabling security software, and restarting VS Code or computers, you can gradually troubleshoot and resolve issues.

How to run java code in notepad How to run java code in notepad Apr 16, 2025 pm 07:39 PM

Although Notepad cannot run Java code directly, it can be achieved by using other tools: using the command line compiler (javac) to generate a bytecode file (filename.class). Use the Java interpreter (java) to interpret bytecode, execute the code, and output the result.

What is vscode What is vscode for? What is vscode What is vscode for? Apr 15, 2025 pm 06:45 PM

VS Code is the full name Visual Studio Code, which is a free and open source cross-platform code editor and development environment developed by Microsoft. It supports a wide range of programming languages ​​and provides syntax highlighting, code automatic completion, code snippets and smart prompts to improve development efficiency. Through a rich extension ecosystem, users can add extensions to specific needs and languages, such as debuggers, code formatting tools, and Git integrations. VS Code also includes an intuitive debugger that helps quickly find and resolve bugs in your code.

Can vscode be used for mac Can vscode be used for mac Apr 15, 2025 pm 07:36 PM

VS Code is available on Mac. It has powerful extensions, Git integration, terminal and debugger, and also offers a wealth of setup options. However, for particularly large projects or highly professional development, VS Code may have performance or functional limitations.

How to use VSCode How to use VSCode Apr 15, 2025 pm 11:21 PM

Visual Studio Code (VSCode) is a cross-platform, open source and free code editor developed by Microsoft. It is known for its lightweight, scalability and support for a wide range of programming languages. To install VSCode, please visit the official website to download and run the installer. When using VSCode, you can create new projects, edit code, debug code, navigate projects, expand VSCode, and manage settings. VSCode is available for Windows, macOS, and Linux, supports multiple programming languages ​​and provides various extensions through Marketplace. Its advantages include lightweight, scalability, extensive language support, rich features and version

What is the main purpose of Linux? What is the main purpose of Linux? Apr 16, 2025 am 12:19 AM

The main uses of Linux include: 1. Server operating system, 2. Embedded system, 3. Desktop operating system, 4. Development and testing environment. Linux excels in these areas, providing stability, security and efficient development tools.

How to check the warehouse address of git How to check the warehouse address of git Apr 17, 2025 pm 01:54 PM

To view the Git repository address, perform the following steps: 1. Open the command line and navigate to the repository directory; 2. Run the "git remote -v" command; 3. View the repository name in the output and its corresponding address.

See all articles