Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Are there any good services or ways to scan for rootkits and backdoors?

I know there are rkhunter and chkrootkit but are they even ideal anymore? They never seem updated and look more like they were good in the early 2000's

share|improve this question
    
Might be worth popping over to SuperUser as opposed to ServerFault. –  francisswest Jun 13 '12 at 20:47
1  
The rkhunter data (signatures) file was last updated this morning. The rkhunter engine was last updated in April. I wouldn't call that out of date... –  Zoredache Jun 13 '12 at 21:11
add comment

2 Answers

up vote 0 down vote accepted

I don't know how often OSSEC updates their rootkit detection but I know it has the capability built in. Below is the link that shows the various checks that are performed - http://www.ossec.net/doc/manual/rootcheck/index.html. Overall I love the product due to it being able to do rootkit checking, integrity checking, and still being a HIDS/HIPS. You can also easily create your own rules to alert on basically anything.

Edit: As far as backdoors go, you can use the process monitoring feature - http://www.ossec.net/doc/manual/monitoring/process-monitoring.html. There is an example on the page that will alert you if the output of a netstat command changes. So if your server is fairly consistent on what ports should be open, this could definitely be a red flag.

share|improve this answer
add comment

http://www.tenable.com/products/nessus

nessus is free for personal use I think. this is up to date.

share|improve this answer
    
That's more of an external vulnerability scanner. Most rootkits periodically check for updates from Command and Control instead of opening a listening port now. –  Hyppy Jun 13 '12 at 20:47
    
what you said is true, though nessus does find things that rootkits tend to modify and indirectly can discover problems related to rk attacks. –  johnshen64 Jun 13 '12 at 20:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.