Installation Linux Malware Detect (Maldet) On CentOS

Linux Malware Detect (LMD) is a malware scanner for Linux released under the GNU GPLv2 license, that is designed around the threats faced in shared hosted environments. Malware Detect is very easy to install on CentOS, regardless of the control panel you utilize (cPanel/WHM, Directadmin, etc). It can be installed on shared hosting servers like cPanel WHM and linux plesk servers.

In addition, threat data is also derived from user submissions with the LMD checkout feature and from malware community resources. The signatures that LMD uses are MD5 file hashes and HEX pattern matches, they are also easily exported to any number of detection tools such as ClamAV.

Installation is very straightforward. 

# cd /usr/local/src
# wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
# tar -zxvf maldetect-current.tar.gz
# cd maldetect-1.4.2
# ./install.sh

After the installation has been completed successfully, you will be presented with the following output.

Linux Malware Detect v1.4.2
 (C) 2002-2011, R-fx Networks 
 (C) 2011, Ryan MacDonald 
inotifywait (C) 2007, Rohan McGovern 
This program may be freely redistributed under the terms of the GNU GPL
installation completed to /usr/local/maldetect
config file: /usr/local/maldetect/conf.maldet
exec file: /usr/local/maldetect/maldet
exec link: /usr/local/sbin/maldet
exec link: /usr/local/sbin/lmd
cron.daily: /etc/cron.daily/maldet
maldet(6073): {sigup} performing signature update check...
maldet(6073): {sigup} local signature set is version 2013102428301
maldet(6073): {sigup} new signature set (2013102428301) available
maldet(6073): {sigup} downloaded http://www.rfxn.com/downloads/md5.dat
maldet(6073): {sigup} downloaded http://www.rfxn.com/downloads/hex.dat
maldet(6073): {sigup} downloaded http://www.rfxn.com/downloads/rfxn.ndb
maldet(6073): {sigup} downloaded http://www.rfxn.com/downloads/rfxn.hdb
maldet(6073): {sigup} downloaded http://www.rfxn.com/downloads/maldet-clean.tgz
maldet(6073): {sigup} signature set update completed
maldet(6073): {sigup} 10849 signatures (8981 MD5 / 1868 HEX)

Configuring LMD

By default all options are fully commented in the configuration file, so configure it according to your needs. But before making any changes let’s have a review of each option below.

  • email_alert : If you would like to receive email alerts, then it should be set to 1.
  • email_subj : Set your email subject here.
  • email_addr : Add your email address to receive malware alerts.
  • quar_hits : The default quarantine action for malware hits, it should be set 1.
  • quar_clean : Cleaning detected malware injections, must set to 1.
  • quar_susp : The default suspend action for users wih hits, set it as per your requirements.
  • quar_susp_minuid : Minimum userid that can be suspended.

Open file /usr/local/maldetect/conf.maldet and make changes according to your needs.

Maldet Commands

To update the maldet use the below commands.
maldet -u or maldet -d

To scan the files particular user
maldet -a /home/username/

It will scan all the files and provide you the output.

To scan all user under public_html paths under /home*/ this can be done with:
root@tranzmedia[~]# maldet --scan-all /home?/?/public_html

To scan the same path but the content that has been created/modified in the last 5 days:
root@tranzmedia[~]# maldet --scan-recent /home?/?/public_html 5

To scan but forget to turn on the quarantine option, you could quarantine all malware results from a previous scan with:
root@tranzmedia[~]# maldet --quarantine SCANID

If you wanted to attempt a clean on all malware results from a previous scan that did not have the feature enabled, you would do with.
root@tranzmedia[~]# maldet --clean SCANID

If you had a file that was quarantined from a false positive or that you simply want to restore (i.e: you manually cleaned it), you can use the following:
root@tranzmedia[~]# maldet --restore config.php.2384
root@tranzmedia[~]# maldet --restore /usr/local/maldetect/quarantine/config.php.2384

That’s it 🙂

Leave a Reply

Your email address will not be published. Required fields are marked *

Social media & sharing icons powered by UltimatelySocial