How to: Rootkit Detection With chrootkit (WIP)
#### Why

WIP

#### How It Works

WIP

#### Goals

WIP

#### References

- http://www.chkrootkit.org/
- https://www.cyberciti.biz/faq/howto-check-linux-rootkist-with-detectors-software/
- https://askubuntu.com/questions/258658/eth0-packet-sniffer-sbin-dhclient

#### Steps

1. Install chkrootkit.

    On Debian based systems:
    
    ``` bash
    sudo apt install chkrootkit
    ```

1. Do a manual scan:

    ``` bash
    sudo chkrootkit
    ```
    
    > ```
    > ROOTDIR is `/'
    > Checking `amd'...                                           not found
    > Checking `basename'...                                      not infected
    > Checking `biff'...                                          not found
    > Checking `chfn'...                                          not infected
    > Checking `chsh'...                                          not infected
    > ...
    > Checking `scalper'...                                       not infected
    > Checking `slapper'...                                       not infected
    > Checking `z2'...                                            chklastlog: nothing deleted
    > Checking `chkutmp'...                                       chkutmp: nothing deleted
    > Checking `OSX_RSPLUG'...                                    not infected
    > ```

1. Make a backup of chkrootkit's configuration file `/etc/chkrootkit.conf`:

    ``` bash
    sudo cp --archive /etc/chkrootkit.conf /etc/chkrootkit.conf-COPY-$(date +"%Y%m%d%H%M%S")
    ```

1. You want chkrootkit to run every day and e-mail you the result.
   
    On Debian based system, chkrootkit comes with cron scripts. To enable them check `/etc/chkrootkit.conf` or use `dpkg-reconfigure` and say `Yes` to the first question:
    
    ``` bash
    sudo dpkg-reconfigure chkrootkit
    ```

([Table of Contents](#table-of-contents))