云网牛站
所在位置:首页 > Linux安全 > CentOS/Fedora/Ubuntu/Debian安装和使用Linux Malware Detect(LMD)

CentOS/Fedora/Ubuntu/Debian安装和使用Linux Malware Detect(LMD)

2019-06-04 09:51:10作者:卫容稿源:云网牛站

Linux Malware Detect(LMD)是一种针对Linux平台的恶意软件扫描程序,是根据GNU GPLv2许可证发布的,该许可证是围绕共享托管环境中面临的威胁而设计的,在本文中,我们将讨论如何在Linux上安装和使用Linux Malware Detect,支持CentOS/Fedora/Ubuntu/Debian/Arch系统,我们将从Github存储库克隆该项目并运行安装程序脚本以使Linux Malware Detect在我们的Linux系统上运行。

CentOS/Fedora/Ubuntu/Debian安装和使用Linux Malware Detect(LMD)

 

一、克隆项目存储库

Linux Malware Detect项目在Github上。使用git命令下载它,可以通过系统软件包管理器轻松安装:

# RHEL/CentOS

sudo yum -y install git

sudo dnf -y install git

# Ubuntu/Debian

sudo apt-get -y install git

# Arch/Manjaro

sudo pacman -S git

克隆来自Github的代码:

$ git clone https://github.com/rfxn/linux-malware-detect.git

Cloning into 'linux-malware-detect'...

remote: Enumerating objects: 81, done.

remote: Counting objects: 100% (81/81), done.

remote: Compressing objects: 100% (49/49), done.

remote: Total 1991 (delta 47), reused 57 (delta 32), pack-reused 1910

Receiving objects: 100% (1991/1991), 1.79 MiB | 1.56 MiB/s, done.

Resolving deltas: 100% (1446/1446), done.

 

二、运行安装程序脚本

源代码在本地可用后,导航到项目目录并使用sudo运行安装程序脚本install.sh:

$ cd linux-malware-detect/

$ sudo ./install.sh

Created symlink from /etc/systemd/system/multi-user.target.wants/maldet.service to /usr/lib/systemd/system/maldet.service.

Linux Malware Detect v1.6.4

(C) 2002-2019, R-fx Networks <proj@r-fx.org>

(C) 2019, Ryan MacDonald <ryan@r-fx.org>

This program may be freely redistributed under the terms of the GNU GPL

installation completed to /usr/local/maldetect

config file: /usr/local/maldetect/conf.maldet

exec file: /usr/local/maldetect/maldet

exec link: /usr/local/sbin/maldet

exec link: /usr/local/sbin/lmd

cron.daily: /etc/cron.daily/maldet

maldet(6686): {sigup} performing signature update check...

maldet(6686): {sigup} could not determine signature version

maldet(6686): {sigup} signature files missing or corrupted, forcing update...

maldet(6686): {sigup} new signature set 2019052829145 available

maldet(6686): {sigup} downloading https://cdn.rfxn.com/downloads/maldet-sigpack.tgz

maldet(6686): {sigup} downloading https://cdn.rfxn.com/downloads/maldet-cleanv2.tgz

maldet(6686): {sigup} verified md5sum of maldet-sigpack.tgz

maldet(6686): {sigup} unpacked and installed maldet-sigpack.tgz

maldet(6686): {sigup} verified md5sum of maldet-clean.tgz

maldet(6686): {sigup} unpacked and installed maldet-clean.tgz

maldet(6686): {sigup} signature set update completed

maldet(6686): {sigup} 15519 signatures (12707 MD5 | 2035 HEX | 777 YARA | 0 USER)

参考:在Linux系统中运行.sh文件的两种方法

确认已安装Linux Malware Detect版本,运行maldet --version命令:

$ maldet --version

Linux Malware Detect v1.6.4

(C) 2002-2019, R-fx Networks proj@rfxn.com

(C) 2019, Ryan MacDonald ryan@rfxn.com

This program may be freely redistributed under the terms of the GNU GPL v2

public scanning is currently disabled (scan_user_access=0), please contact your system administrator to enable scan_user_access in conf.maldet.

 

三、配置Linux Malware Detect(LMD)

Linux Malware Detect的主要配置文件位于/usr/local/maldetect/conf.maldet中。

要进行更改,请使用你喜欢的编辑器打开文件进行编辑:

$ sudo vim /usr/local/maldetect/conf.maldet

参考:玩转Linux必备的Vim技能,一文读懂Vim的安装和配置,学习之法

或者:

$ sudo nano /usr/local/maldetect/conf.maldet

要接收警报,请启用警报并设置电子邮件地址:

email_alert="1"

email_addr="you@domain.com"

浏览整个文件并对其进行配置以适合你的hankered用途。

 

四、使用Linux Malware Detect(LMD)

1、使用Linux Malware Detect扫描目录

要使用Scan directory with扫描目录中的恶意软件,请使用命令语法:

$ sudo maldet -a /path/to/directory

-a或--scan-all选项意味着扫描路径中的所有文件,如果没有指定目录,它将默认为/home,可以使用通配符,例如:

maldet -a /home/?/public_html

要检查所有可用选项,请使用:

$ sudo maldet --help

例如:

$ sudo maldet -a /srv/

Linux Malware Detect v1.6.4

(C) 2002-2019, R-fx Networks <proj@rfxn.com>

(C) 2019, Ryan MacDonald <ryan@rfxn.com>

This program may be freely redistributed under the terms of the GNU GPL v2

maldet(3872): {scan} signatures loaded: 15519 (12707 MD5 | 2035 HEX | 777 YARA | 0 USER)

maldet(3872): {scan} building file list for /srv/, this might take awhile...

maldet(3872): {scan} setting nice scheduler priorities for all operations: cpunice 19 , ionice 6

maldet(3872): {scan} file list completed in 1s, found 110257 files...

maldet(3872): {scan} found clamav binary at /bin/clamscan, using clamav scanner engine...

maldet(3872): {scan} scan of /srv/ (110257 files) in progress...

maldet(3872): {scan} processing scan results for hits: 1 hits 0 cleaned

maldet(3872): {scan} scan completed on /srv/: files 110257, malware hits 1, cleaned hits 0, time 467s

maldet(3872): {scan} scan report saved, to view run: maldet --report 190603-1946.3872

maldet(3872): {scan} quarantine is disabled! set quarantine_hits=1 in conf.maldet or to quarantine results run: maldet -q 190603-1946.3872

通过运行结尾附近显示的命令查看扫描结果:

$ sudo maldet --report 190603-1946.3872

2、扫描行间隔文件中定义的文件或路径

你还可以指定包含要扫描的路径列表的文件:

$ cat files_to_scan.list

/srv

/var

/root

/home

/var/www/?/public_html

然后运行扫描:

$ maldet  -f  /root/files_to_scan.list

Linux Malware Detect v1.6.4

(C) 2002-2019, R-fx Networks <proj@rfxn.com>

(C) 2019, Ryan MacDonald <ryan@rfxn.com>

This program may be freely redistributed under the terms of the GNU GPL v2

maldet(4248): {scan} signatures loaded: 15519 (12707 MD5 | 2035 HEX | 777 YARA | 0 USER)

maldet(4248): {scan} user supplied file list '/root/files_to_scan.list', found 5 files...

maldet(4248): {scan} scan of  (5 files) in progress...

maldet(4248): {scan} 5/5 files scanned: 0 hits 0 cleaned

maldet(4248): {scan} scan completed on : files 5, malware hits 0, cleaned hits 0, time 0s

maldet(4248): {scan} scan report saved, to view run: maldet --report 190603-0951.4248

要查看生成的扫描,请运行命令:

$ maldet --report 190603-0951.4248

3、仅扫描最近x天内修改的文件

如果只需要扫描在过去X天内创建/修改的文件,请使用-r选项,如果未传递任何参数,则默认值为最近7天。

下面的示例将扫描/srv目录以查找过去5天内修改的文件:

sudo maldet -r /srv 5

检查网站内容目录,最近10天:

sudo maldet -r /var/www/?/public_html 10

4、更新Linux Malware Detect

要更新,请运行:

$ sudo maldet -u

Linux Malware Detect v1.6.4

(C) 2002-2019, R-fx Networks <proj@rfxn.com>

(C) 2019, Ryan MacDonald <ryan@rfxn.com>

This program may be freely redistributed under the terms of the GNU GPL v2

maldet(6021): {sigup} performing signature update check...

maldet(6021): {sigup} local signature set is version 201906014705

maldet(6021): {sigup} latest signature set already installed

5、更新已安装的LMD版本

获取最新版本的LMD,请使用:

$ sudo maldet -d

Linux Malware Detect v1.6.4

(C) 2002-2019, R-fx Networks <proj@rfxn.com>

(C) 2019, Ryan MacDonald <ryan@rfxn.com>

This program may be freely redistributed under the terms of the GNU GPL v2

maldet(6212): {update} checking for available updates...

maldet(6212): {update} hashing install files and checking against server...

maldet(6212): {update} latest version already installed.

6、在指定用户下执行

如果将扫描作为cron作业或脚本运行,则可能需要指定要执行的用户,这非常适合从用户隔离区恢复或查看用户报告,见下面的例子:

$ maldet --user nobody --report

$ maldet --user nobody --restore 050910-1534.21135

7、清除日志,隔离队列,会话和临时数据

要清除上述列表中的所有文件,请使用-p选项:

maldetect -p

 

相关主题

使用Maldet检测和清除Linux中的恶意软件

精选文章
热门文章