RE: [cobalt-users] chkrootkit

[Bob G7 <Bob_G7@xxxxxxxxxx>]

> 
> Gerald Waugh wrote:
> 
> > Seems like I have heard that before.
> > And it does seem to be a reasonable explnation.
> 
> Yes, it's right, and it does happen.  But if you get repeated positives
> you probably do have a problem; we generally don't get repeated
> positives even in checking hourly.
> 
> You can check as often as you want by putting some code into a cron job:
> 
>  #!/bin/sh
>  cd /root/installed/chkrootkit-0.35/
>  ./chkrootkit > /root/chkrootkit.out
>  mail your@xxxxxxxxx < /root/chkrootkit.out
> 
> (Be sure to fix your paths to match your system.)
> 
Slight variation to the above script:

#!/bin/sh
cd /home/tools/chkrootkit-0.35
./chkrootkit > /root/chkrootkit.out
mail -s "Hacking Check" your@xxxxxxxxx < /root/chkrootkit.out

To test that it will work, enter sh /etc/cron.daily/chkrootkit.sh

In a few minutes after it finishes you shough get an email