Saturday, November 18, 2006

A useful script for chkrootkit

This script is useful as crontab task ;)

You need ssmtp in order to use it:

* mail-mta/ssmtp
Latest version available: 2.61-r2
Latest version installed: 2.61-r2
Size of downloaded files: 156 kB
Homepage: ftp://ftp.debian.org/debian/pool/main/s/ssmtp/
Description: Extremely simple MTA to get mail off the system to a Mailhub
License: GPL-2


#!/bin/bash

MAIL_ADDRESS=insert_here_your_mail_address

echo -e "Subject: Chkrootkit of: `date`\n" > /tmp/chkrootkit.mail
/usr/sbin/chkrootkit >> /tmp/chkrootkit.mail

SYSTEM_STATUS=`cat /tmp/chkrootkit.mail | grep INFECTED`

# Check if system was infected!!!
if [ "$SYSTEM_STATUS" ]; then
echo >> /tmp/chkrootkit.mail
echo "************************************" >> /tmp/chkrootkit.mail
echo "* YOUR SYSTEM WAS INFECTED *" >> /tmp/chkrootkit.mail
echo "************************************" >> /tmp/chkrootkit.mail
echo >> /tmp/chkrootkit.mail
fi

# Sending mail
cat /tmp/chkrootkit.mail | ssmtp $MAIL_ADDRESS

# Remove temp file
rm -f /tmp/chkrootkit.mail

No comments:

Post a Comment