locally checks for signs of a rootkit

chkrootkit looks for known "signatures" in trojaned system binaries. For example, some trojaned versions of ps have "/dev/ptyp" inside them.

Obviously an attacker can easily modify the rootkit sources to change its signatures and avoid chkrootkit detection. See next question.

If chkrootkit can't find a known signature inside a file, it can't automatically determine if it has been trojaned. Try to run chkrootkit in expert mode (-x option) -- in this mode the user can examine suspicious strings in the binary programs that may indicate a trojan.

For example, lots of data can be seen with:

# ./chkrootkit -x | more

Pathnames inside system commands:

# ./chkrootkit -x | egrep '^/'

Not all systems have Perl available. The motivation was to write a simple tool that could be run in systems with minimal installation.

The following commands are used by the chkrootkit script:

awk, cut, echo, egrep, find, head, id, ls, netstat, ps, strings, sed, uname

Probably not. We suggest you follow one of the alternatives below:

1. Use the `-p path' option to supply an alternate path to binaries you trust:

   
   # ./chkrootkit -p /cdrom/bin
   
   

2. Mount the compromised machine's disk on a machine you trust and specify a new rootdir with the `-r rootdir' option:

   
   # ./chkrootkit -r /mnt
   
   

If you run chkproc on a server that runs lots of short time processes it could report some false positives. chkproc compares the ps output with the /proc contents. If processes are created/killed during this operation chkproc could point out these PIDs as suspicious.

If you're running PortSentry/klaxon or another program that binds itself to unused ports probably chkrootkit will give you a false positive on the bindshell test (ports 114/tcp, 465/tcp, 511/tcp, 1008/tcp, 1524/tcp, 1999/tcp, 3879/tcp, 4369/tcp, 5665/tcp, 10008/tcp, 12321/tcp, 23132/tcp, 27374/tcp, 29364/tcp, 31336/tcp, 31337/tcp, 45454/tcp, 47017/tcp, 47889/tcp, 60001/tcp).

Ignoring some files and dirs could impair chkrootkit's accuracy. An attacker might use this, since he knows that chkrootkit will ignore certain files and dirs.

Yes. For example, to run chkrootkit every day at 3am and mail the output to root: