|
Linux Malware Detect（LMD）是一种针对Linux平台的恶意软件扫描程序，是根据GNU GPLv2许可证发布的，该许可证是围绕共享托管环境中面临的威胁而设计的，在本文中，我们将讨论如何在Linux上安装和使用Linux Malware Detect，支持CentOS/Fedora/Ubuntu/Debian/Arch系统，我们将从Github存储库克隆该项目并运行安装程序脚本以使Linux Malware Detect在我们的Linux系统上运行。
一、克隆项目存储库 Linux Malware Detect项目在Github上。使用git命令下载它，可以通过系统软件包管理器轻松安装： # RHEL/CentOS sudo yum -y install git sudo dnf -y install git # Ubuntu/Debian sudo apt-get -y install git # Arch/Manjaro sudo pacman -S git 克隆来自Github的代码： $ git clone https://github.com/rfxn/linux-malware-detect.git Cloning into 'linux-malware-detect'... remote: Enumerating objects: 81, done. remote: Counting objects: 100% (81/81), done. remote: Compressing objects: 100% (49/49), done. remote: Total 1991 (delta 47), reused 57 (delta 32), pack-reused 1910 Receiving objects: 100% (1991/1991), 1.79 MiB | 1.56 MiB/s, done. Resolving deltas: 100% (1446/1446), done.
二、运行安装程序脚本 源代码在本地可用后，导航到项目目录并使用sudo运行安装程序脚本install.sh： $ cd linux-malware-detect/ $ sudo ./install.sh Created symlink from /etc/systemd/system/multi-user.target.wants/maldet.service to /usr/lib/systemd/system/maldet.service. Linux Malware Detect v1.6.4 (C) 2002-2019, R-fx Networks <proj@r-fx.org> (C) 2019, Ryan MacDonald <ryan@r-fx.org> This program may be freely redistributed under the terms of the GNU GPL installation completed to /usr/local/maldetect config file: /usr/local/maldetect/conf.maldet exec file: /usr/local/maldetect/maldet exec link: /usr/local/sbin/maldet exec link: /usr/local/sbin/lmd cron.daily: /etc/cron.daily/maldet maldet(6686): {sigup} performing signature update check... maldet(6686): {sigup} could not determine signature version maldet(6686): {sigup} signature files missing or corrupted, forcing update... maldet(6686): {sigup} new signature set 2019052829145 available maldet(6686): {sigup} downloading https://cdn.rfxn.com/downloads/maldet-sigpack.tgz maldet(6686): {sigup} downloading https://cdn.rfxn.com/downloads/maldet-cleanv2.tgz maldet(6686): {sigup} verified md5sum of maldet-sigpack.tgz maldet(6686): {sigup} unpacked and installed maldet-sigpack.tgz maldet(6686): {sigup} verified md5sum of maldet-clean.tgz maldet(6686): {sigup} unpacked and installed maldet-clean.tgz maldet(6686): {sigup} signature set update completed maldet(6686): {sigup} 15519 signatures (12707 MD5 | 2035 HEX | 777 YARA | 0 USER) 确认已安装Linux Malware Detect版本，运行maldet --version命令： $ maldet --version Linux Malware Detect v1.6.4 (C) 2002-2019, R-fx Networks proj@rfxn.com (C) 2019, Ryan MacDonald ryan@rfxn.com This program may be freely redistributed under the terms of the GNU GPL v2 public scanning is currently disabled (scan_user_access=0), please contact your system administrator to enable scan_user_access in conf.maldet.
三、配置Linux Malware Detect（LMD） Linux Malware Detect的主要配置文件位于/usr/local/maldetect/conf.maldet中。 要进行更改，请使用你喜欢的编辑器打开文件进行编辑： $ sudo vim /usr/local/maldetect/conf.maldet 参考：玩转Linux必备的Vim技能，一文读懂Vim的安装和配置，学习之法。 或者： $ sudo nano /usr/local/maldetect/conf.maldet 要接收警报，请启用警报并设置电子邮件地址： email_alert="1" email_addr="you@domain.com" 浏览整个文件并对其进行配置以适合你的hankered用途。
四、使用Linux Malware Detect（LMD） 1、使用Linux Malware Detect扫描目录 要使用Scan directory with扫描目录中的恶意软件，请使用命令语法： $ sudo maldet -a /path/to/directory -a或--scan-all选项意味着扫描路径中的所有文件，如果没有指定目录，它将默认为/home，可以使用通配符，例如： maldet -a /home/?/public_html 要检查所有可用选项，请使用： $ sudo maldet --help 例如： $ sudo maldet -a /srv/ Linux Malware Detect v1.6.4 (C) 2002-2019, R-fx Networks <proj@rfxn.com> (C) 2019, Ryan MacDonald <ryan@rfxn.com> This program may be freely redistributed under the terms of the GNU GPL v2 maldet(3872): {scan} signatures loaded: 15519 (12707 MD5 | 2035 HEX | 777 YARA | 0 USER) maldet(3872): {scan} building file list for /srv/, this might take awhile... maldet(3872): {scan} setting nice scheduler priorities for all operations: cpunice 19 , ionice 6 maldet(3872): {scan} file list completed in 1s, found 110257 files... maldet(3872): {scan} found clamav binary at /bin/clamscan, using clamav scanner engine... maldet(3872): {scan} scan of /srv/ (110257 files) in progress... maldet(3872): {scan} processing scan results for hits: 1 hits 0 cleaned maldet(3872): {scan} scan completed on /srv/: files 110257, malware hits 1, cleaned hits 0, time 467s maldet(3872): {scan} scan report saved, to view run: maldet --report 190603-1946.3872 maldet(3872): {scan} quarantine is disabled! set quarantine_hits=1 in conf.maldet or to quarantine results run: maldet -q 190603-1946.3872 通过运行结尾附近显示的命令查看扫描结果： $ sudo maldet --report 190603-1946.3872 2、扫描行间隔文件中定义的文件或路径 你还可以指定包含要扫描的路径列表的文件： $ cat files_to_scan.list /srv /var /root /home /var/www/?/public_html 然后运行扫描： $ maldet -f /root/files_to_scan.list Linux Malware Detect v1.6.4 (C) 2002-2019, R-fx Networks <proj@rfxn.com> (C) 2019, Ryan MacDonald <ryan@rfxn.com> This program may be freely redistributed under the terms of the GNU GPL v2 maldet(4248): {scan} signatures loaded: 15519 (12707 MD5 | 2035 HEX | 777 YARA | 0 USER) maldet(4248): {scan} user supplied file list '/root/files_to_scan.list', found 5 files... maldet(4248): {scan} scan of (5 files) in progress... maldet(4248): {scan} 5/5 files scanned: 0 hits 0 cleaned maldet(4248): {scan} scan completed on : files 5, malware hits 0, cleaned hits 0, time 0s maldet(4248): {scan} scan report saved, to view run: maldet --report 190603-0951.4248 要查看生成的扫描，请运行命令： $ maldet --report 190603-0951.4248 3、仅扫描最近x天内修改的文件 如果只需要扫描在过去X天内创建/修改的文件，请使用-r选项，如果未传递任何参数，则默认值为最近7天。 下面的示例将扫描/srv目录以查找过去5天内修改的文件： sudo maldet -r /srv 5 检查网站内容目录，最近10天： sudo maldet -r /var/www/?/public_html 10 4、更新Linux Malware Detect 要更新，请运行： $ sudo maldet -u Linux Malware Detect v1.6.4 (C) 2002-2019, R-fx Networks <proj@rfxn.com> (C) 2019, Ryan MacDonald <ryan@rfxn.com> This program may be freely redistributed under the terms of the GNU GPL v2 maldet(6021): {sigup} performing signature update check... maldet(6021): {sigup} local signature set is version 201906014705 maldet(6021): {sigup} latest signature set already installed 5、更新已安装的LMD版本 获取最新版本的LMD，请使用： $ sudo maldet -d Linux Malware Detect v1.6.4 (C) 2002-2019, R-fx Networks <proj@rfxn.com> (C) 2019, Ryan MacDonald <ryan@rfxn.com> This program may be freely redistributed under the terms of the GNU GPL v2 maldet(6212): {update} checking for available updates... maldet(6212): {update} hashing install files and checking against server... maldet(6212): {update} latest version already installed. 6、在指定用户下执行 如果将扫描作为cron作业或脚本运行，则可能需要指定要执行的用户，这非常适合从用户隔离区恢复或查看用户报告，见下面的例子： $ maldet --user nobody --report $ maldet --user nobody --restore 050910-1534.21135 7、清除日志，隔离队列，会话和临时数据 要清除上述列表中的所有文件，请使用-p选项： maldetect -p
相关主题 |
