How to Install and Configure maldet (Linux Malware Detect – LMD)

malware

Maldet is also known as Linux Malware Detect virus scanner for Linux.

Linux Malware Detect (LMD) is a Linux malware scanner released under the GNU GPLv2 license designed to address the threats in shared host environments.

To extract malware that is actively used in attacks and generates signatures for detection, it uses threat data from network edge intrusion detection systems.

Additionally, risk information is also extracted from user submissions using the LMD checkout function and resources from the malware community.

The signatures used by LMD are hashes of MD5 files and matches of HEX patterns, as well as being quickly exported to any number of detection tools like ClamAV. To install LMD, download the package and run the enclosed install.sh script

Download maldetect package using wget

Go to the below path

cd /usr/local/src/

Download the tar file using the below link:

wget http://www.rfxn.com/downloads/maldetect-current.tar.gz

Extract the file using the below command

tar -xzf maldetect-current.tar.gz

go to the maldet folder

cd maldetect-*

Now, run the below command to install maldet.

sh ./install.sh or sudo sh ./install.sh

It will give below output

Linux Malware Detect v1.3.4
(C) 1999-2010, R-fx Networks <[email protected]>
(C) 2010, Ryan MacDonald <[email protected]>
inotifywait (C) 2007, Rohan McGovern <[email protected]>
This program may be freely redistributed under the terms of the GNU GPL

installation completed to /usr/local/maldetect
config file: /usr/local/maldetect/conf.maldet
exec file: /usr/local/maldetect/maldet
exec link: /usr/local/sbin/maldet
cron.daily: /etc/cron.daily/maldet

maldet(32517): {sigup} performing signature update check…
maldet(32517): {sigup} local signature set is version 2010051510029
maldet(32517): {sigup} latest signature set already installed

Step 3: Configuring LMD
By default all options are fully commented in the configuration file, so configure it according to your needs. But before making any changes let’s have a detailed review of each option below.

  1. email_alert : If you would like to receive email alerts, then it should be set to 1.
  2. email_subj : Set your email subject here.
  3. email_addr : Add your email address to receive malware alerts.
  4. quar_hits : The default quarantine action for malware hits, it should be set 1.
  5. quar_clean : Cleaning detected malware injections, must set to 1.
  6. quar_susp : The default suspend action for users wih hits, set it as per your requirements.
  7. quar_susp_minuid : Minimum userid that can be suspended.

Open file /usr/local/maldetect/conf.maldet and make changes according to your needs

nano /usr/local/maldetect/conf.maldet

To update the maldet use the below commands.

maldet -u or maldet -d

To scan the files. perticular user

maldet -a /home/username/

It will scan all the files and provide you the output.

To scan all user under public_html paths under /home*/ this can be done with:

[email protected][~]# maldet –scan-all /home?/?/public_html

or

[email protected][~]-maldet –scan-all /home

To scan the same path but the content that has been created/modified in the last 5 days:

[email protected][~]# maldet –scan-recent /home?/?/public_html 5

To scan but forget to turn on the quarantine option, you could quarantine all malware results from a previous scan with:

[email protected][~]# maldet –quarantine SCANID

If you wanted to attempt a clean on all malware results from a previous scan that did not have the feature enabled, you would do with.

[email protected]rver[~]# maldet –clean SCANID

If you had a file that was quarantined from a false positive or that you simply want to restore (i.e: you manually cleaned it), you can use the following:

[email protected][~]# maldet –restore config.php.2384
[email protected][~]# maldet –restore /usr/local/maldetect/quarantine/config.php.2384

Do you know TNP HOST VPS are monitored using other premium malware detection tools and maldet too.

Get 5 % off on your next VPS subscription order, contact our sales today at [email protected]

Was this post helpful?

Leave A Comment?

This site uses Akismet to reduce spam. Learn how your comment data is processed.