SysAdminGear

Keep you server clean of rookits is a good idea to get a good security level. A sysadministrator can create a seperate partition for /tmp and mount it with noexec and nosuid parameters. And to do it is not necessary to reboot or repartition your drive.

1. First you should secure /tmp:

Make a 1GB file for /tmp parition and an ext3 filesystem for tmp:
# dd if=/dev/zero of=/dev/tmpFS bs=1024 count=1000000
# /sbin/mkfs.ext3 /dev/tmpFS

Create a backup copy of your current /tmp drive:
# cp -Rpf /tmp /tmpbackup

Mount our new tmp parition and change permissions:
# mount -o loop,noexec,nosuid,rw /dev/tmpFS /tmp
# chmod 1777 /tmp

Copy the old data:
cp -Rpf /tmpbackup/* /tmp/

If you run the mount command and you should get something like this:
/dev/tmpMnt on /tmp type ext3 (rw,noexec,nosuid,loop=/dev/loop0)

Edit /etc/fstab and add this:
/dev/tmpMnt /tmp ext3 loop,nosuid,noexec,rw 0 0

Test your fstab entry:
# mount -o remount /tmp

You can test it runnig a script on /tmp partitio, if you get "permission denied" it is fine :)


2. Secure /var/tmp:

It should be done because some applications use /var/tmp as the temporary folder, and anything that's accessible by all, needs to be secured.

Rename it and create a symbolic link to /tmp:
# mv /var/tmp /var/tmp1
# ln -s /tmp /var/tmp

Copy the old data back:
# cp /var/tmpold/* /tmp/

Note: you should restart and services that uses /tmp partition

3. Securing /dev/shm:

To get all the work well done, you should secure /dev/shm to stop rootkits running here.

Edit your /etc/fstab:
# nano /etc/fstab

change:
"none /dev/shm tmpfs defaults,rw 0 0" to
"none /dev/shm tmpfs defaults,nosuid,noexec,rw 0 0"

Remount /dev/shm:
# mount -o remount /dev/shm

It should be fine now. You can also read related posts:
How to install Rkhunter
How to install Rootcheck

If you are running a Web Server, Mail Server, Hosting Server or VPS Server and you need to provide security against rootkits, so we recommend you to install Rkhunter.

RKhunter is compatible with the most popular Hosting Control Panels like cPanel, Plesk, Ensim etc.

"Rootkit scanner is scanning tool to ensure you for about 99.9%* you're clean of nasty tools.
This tool scans for rootkits, backdoors and local exploits by running tests like:
- MD5 hash compare
- Look for default files used by rootkits
- Wrong file permissions for binaries
- Look for suspected strings in LKM and KLD modules
- Look for hidden files
- Optional scan within plaintext and binary files
Rootkit Hunter is released as GPL licensed project and free for everyone to use.
* No, not really 99.9%.. It's just another security layer"
( http://www.rootkit.nl/ )


Install Rkhunter:
# wget http://downloads.rootkit.nl/rkhunter-1.2.7.tar.gz
# tar -zxvf rkhunter-1.2.7.tar.gz
# cd rkhunter-1.2.7
# ./installer.sh

Update Rkhunter:
# rkhunter --update

Run a Test Scan (help to prevent false positives):
# /usr/local/bin/rkhunter -c

Setup a daily scan report:
# nano /etc/cron.daily/rkhunter.sh

and add it:
#!/bin/bash
(/usr/local/bin/rkhunter -c --cronjob 2>&1 mail -s "Daily Rkhunter Scan Report" email@domain.com)

Change premissions:
# chmod +x /etc/cron.daily/rkhunter.sh

Rootcheck Description:
"Rootcheck is an open source rootkit detection software. It scans the whole system looking for known rootkits and also for the presence of unknown rootkits and kernel level ones using anomaly detection. Rootcheck is also integrated with the OSSEC HIDS, providing a powerful host-based IDS solution. It includes log analysis, file integrity change detection and rootkit detection (all in one simple to use package). "
(Font: http://www.ossec.net/ )

Login as root to your server

Download rootcheck source and install:
# wget http://www.ossec.net/rootcheck/files/rootcheck-0.7.tar.gz
# tar -xvzf rootcheck-0.7.tar.gz
# cd rootcheck-0.7
# ./install
# ./rootcheck.pl

It should be fine.

Remember to always look for updates in the signatures before using it, the signatures are posted at www.ossec.net/rootkits/

Check the manual and configuration options:
http://www.ossec.net/en/manual.html#config