Deteksi rootkit dengan rkhunter

Sering kali ketika kita menjadi admin sebuah server, tidak pasti apakah telah terjadi sesuatu terhadap server kita, apakah sudah ada penyusup yang menanam aplikasi jahat yang membuat server kita bisa di remote dengan leluasa.

Atau mungkin ada seseorang yang bisa login ke server kita dan berhasil menanamkan rootkit di server kita sehingga server bisa dikendalikan dengan leluasa oleh mereka?

Cara manual dengan mencari satu-satu mungkin bisa dilakukan tetapi akan sangat memakan waktu. rkhunter adalah salah satu aplikasi yang mampu mencari dan mendeteksi keberadaan banyak sekali rootkit yang sudah terkenal.

rkhunter yang saya ceritakan sekarang ini berjalan pada *nix baik itu linux maupun bsd. Untuk saat ini saya akan menunjukan cara installasi di FreeBSD, tetapi jangan takut installasi rkhunter di *nix sama mudah nya.

Berikut ini langkah-langkah installasi rkhunter di FreeBSD

cd /usr/ports/security/rkhunter
make config
make install clean

Setelah anda mengetikan make config anda akan diberikan pilihan apakah rkhunter yang akan diinstall support lsof dan nmap atau salah satunya saja. Disini saya pilih dua-duanya biar lebih mantap.
Setelah proses installasi selesai anda diminta untuk memasukan

daily_rkhunter_update_enable=”YES”

dan

daily_rkhunter_check_enable=”YES”

kedalam file /etc/periodic.conf supaya database nya selalu up-to-date dan rkhunter melakukan checking setiap hari.
Tetapi tentu saja itu adalah sebuah pilihan dimana saya sendiri tidak melakukan hal tersebut karena tahu bahwa rkhunter tidak melakukan update database nya setiap hari dan juga kalau rkhunter melakukan check setiap hari sementara saya tidak membaca log nya itu akan percuma.
Jadi saya memilih untuk melakukan update dan check hanya ketika perlu saja.
Berikut ini perintah untuk melakukan update

rkhunter --update
[ Rootkit Hunter version 1.3.2 ]

Checking rkhunter data files...
  Checking file mirrors.dat                                  [ No update ]
  Checking file programs_bad.dat                             [ No update ]
  Checking file backdoorports.dat                            [ No update ]
  Checking file suspscan.dat                                 [ No update ]
  Checking file i18n/cn                                      [ Updated ]
  Checking file i18n/en                                      [ No update ]
  Checking file i18n/zh                                      [ No update ]
  Checking file i18n/zh.utf8                                 [ No update ]

seperti yang terlihat diatas update hanya tersedia uptuk file i18n/cn

Setelah yakin bahwa rkhunter anda menggunakan database terbaru sekarang kita lakukan proses pengecekan (hasil dari scan rkhunter tidak saya potong biar terlihat semuanya jadi akan sangat panjang).

rkhunter -c
[ Rootkit Hunter version 1.3.2 ]

Checking system commands...

  Performing 'strings' command checks
    Checking 'strings' command                               [ OK ]

  Performing 'shared libraries' checks
    Checking for preloading variables                        [ None found ]
    Checking for preload file                                [ Not found ]
    Checking LD_LIBRARY_PATH variable                        [ Not found ]

  Performing file properties checks
    Checking for prerequisites                               [ Warning ]
    /bin/bash                                                [ OK ]
    /bin/cat                                                 [ OK ]
    /bin/chmod                                               [ OK ]
    /bin/chown                                               [ OK ]
    /bin/cp                                                  [ OK ]
    /bin/csh                                                 [ OK ]
    /bin/date                                                [ OK ]
    /bin/df                                                  [ OK ]
    /bin/echo                                                [ OK ]
    /bin/ed                                                  [ OK ]
    /bin/kill                                                [ OK ]
    /bin/ls                                                  [ OK ]
    /bin/md5                                                 [ OK ]
    /bin/mv                                                  [ OK ]
    /bin/passwd                                              [ OK ]
    /bin/ps                                                  [ OK ]
    /bin/pwd                                                 [ OK ]
    /bin/sed                                                 [ OK ]
    /bin/sh                                                  [ OK ]
    /bin/su                                                  [ OK ]
    /bin/test                                                [ OK ]
    /usr/bin/awk                                             [ OK ]
    /usr/bin/basename                                        [ OK ]
    /usr/bin/cut                                             [ OK ]
    /usr/bin/diff                                            [ OK ]
    /usr/bin/dirname                                         [ OK ]
    /usr/bin/du                                              [ OK ]
    /usr/bin/egrep                                           [ OK ]
    /usr/bin/env                                             [ OK ]
    /usr/bin/fgrep                                           [ OK ]
    /usr/bin/file                                            [ OK ]
    /usr/bin/find                                            [ OK ]
    /usr/bin/grep                                            [ OK ]
    /usr/bin/groups                                          [ OK ]
    /usr/bin/head                                            [ OK ]
    /usr/bin/id                                              [ OK ]
    /usr/bin/killall                                         [ OK ]
    /usr/bin/last                                            [ OK ]
    /usr/bin/ldd                                             [ OK ]
    /usr/bin/less                                            [ OK ]
    /usr/bin/locate                                          [ OK ]
    /usr/bin/logger                                          [ OK ]
    /usr/bin/login                                           [ OK ]
    /usr/bin/lynx                                            [ OK ]
    /usr/bin/mail                                            [ OK ]
    /usr/bin/mktemp                                          [ OK ]
    /usr/bin/more                                            [ OK ]
    /usr/bin/netstat                                         [ OK ]
    /usr/bin/newgrp                                          [ OK ]
    /usr/bin/passwd                                          [ OK ]
    /usr/bin/perl                                            [ OK ]
    /usr/bin/readlink                                        [ OK ]
    /usr/bin/sed                                             [ OK ]
    /usr/bin/size                                            [ OK ]
    /usr/bin/sockstat                                        [ OK ]
    /usr/bin/sort                                            [ OK ]
    /usr/bin/stat                                            [ OK ]
    /usr/bin/strings                                         [ OK ]
    /usr/bin/su                                              [ OK ]
    /usr/bin/systat                                          [ OK ]
    /usr/bin/tail                                            [ OK ]
    /usr/bin/top                                             [ OK ]
    /usr/bin/touch                                           [ OK ]
    /usr/bin/tr                                              [ OK ]
    /usr/bin/uname                                           [ OK ]
    /usr/bin/uniq                                            [ OK ]
    /usr/bin/users                                           [ OK ]
    /usr/bin/vmstat                                          [ OK ]
    /usr/bin/w                                               [ OK ]
    /usr/bin/wc                                              [ OK ]
    /usr/bin/wget                                            [ OK ]
    /usr/bin/whatis                                          [ OK ]
    /usr/bin/whereis                                         [ OK ]
    /usr/bin/which                                           [ OK ]
    /usr/bin/who                                             [ OK ]
    /usr/bin/whoami                                          [ OK ]
    /sbin/dmesg                                              [ OK ]
    /sbin/ifconfig                                           [ OK ]
    /sbin/init                                               [ OK ]
    /sbin/md5                                                [ OK ]
    /sbin/mount                                              [ OK ]
    /sbin/nologin                                            [ OK ]
    /sbin/sha1                                               [ OK ]
    /sbin/sysctl                                             [ OK ]
    /sbin/kldload                                            [ OK ]
    /sbin/kldstat                                            [ OK ]
    /sbin/kldunload                                          [ OK ]
    /usr/sbin/adduser                                        [ OK ]
    /usr/sbin/amd                                            [ OK ]
    /usr/sbin/chown                                          [ OK ]
    /usr/sbin/chroot                                         [ OK ]
    /usr/sbin/cron                                           [ OK ]
    /usr/sbin/inetd                                          [ OK ]
    /usr/sbin/newsyslog                                      [ OK ]
    /usr/sbin/nologin                                        [ OK ]
    /usr/sbin/pkg_info                                       [ OK ]
    /usr/sbin/syslogd                                        [ OK ]
    /usr/sbin/vipw                                           [ OK ]
    /usr/sbin/watch                                          [ OK ]
    /usr/local/bin/bash                                      [ OK ]
    /usr/local/bin/curl                                      [ OK ]
    /usr/local/bin/lynx                                      [ OK ]
    /usr/local/bin/perl                                      [ OK ]
    /usr/local/bin/rkhunter                                  [ OK ]
    /usr/local/bin/wget                                      [ OK ]
    /usr/local/bin/perl5.8.8                                 [ OK ]
    /usr/local/sbin/lsof                                     [ OK ]
    /usr/local/sbin/pkgdb                                    [ OK ]
    /usr/libexec/tcpd                                        [ OK ]

[Press  to continue]


Checking for rootkits...

  Performing check of known rootkit files and directories
    55808 Trojan - Variant A                                 [ Not found ]
    ADM Worm                                                 [ Not found ]
    AjaKit Rootkit                                           [ Not found ]
    aPa Kit                                                  [ Not found ]
    Apache Worm                                              [ Not found ]
    Ambient (ark) Rootkit                                    [ Not found ]
    Balaur Rootkit                                           [ Not found ]
    BeastKit Rootkit                                         [ Not found ]
    beX2 Rootkit                                             [ Not found ]
    BOBKit Rootkit                                           [ Not found ]
    CiNIK Worm (Slapper.B variant)                           [ Not found ]
    Danny-Boy's Abuse Kit                                    [ Not found ]
    Devil RootKit                                            [ Not found ]
    Dica-Kit Rootkit                                         [ Not found ]
    Dreams Rootkit                                           [ Not found ]
    Duarawkz Rootkit                                         [ Not found ]
    Enye LKM                                                 [ Not found ]
    Flea Linux Rootkit                                       [ Not found ]
    FreeBSD Rootkit                                          [ Not found ]
    Fuck`it Rootkit                                          [ Not found ]
    GasKit Rootkit                                           [ Not found ]
    Heroin LKM                                               [ Not found ]
    HjC Kit                                                  [ Not found ]
    ignoKit Rootkit                                          [ Not found ]
    ImperalsS-FBRK Rootkit                                   [ Not found ]
    Irix Rootkit                                             [ Not found ]
    Kitko Rootkit                                            [ Not found ]
    Knark Rootkit                                            [ Not found ]
    Li0n Worm                                                [ Not found ]
    Lockit / LJK2 Rootkit                                    [ Not found ]
    Mood-NT Rootkit                                          [ Not found ]
    MRK Rootkit                                              [ Not found ]
    Ni0 Rootkit                                              [ Not found ]
    Ohhara Rootkit                                           [ Not found ]
    Optic Kit (Tux) Worm                                     [ Not found ]
    Oz Rootkit                                               [ Not found ]
    Phalanx Rootkit                                          [ Not found ]
    Portacelo Rootkit                                        [ Not found ]
    R3dstorm Toolkit                                         [ Not found ]
    RH-Sharpe's Rootkit                                      [ Not found ]
    RSHA's Rootkit                                           [ Not found ]
    Scalper Worm                                             [ Not found ]
    Sebek LKM                                                [ Not found ]
    Shutdown Rootkit                                         [ Not found ]
    SHV4 Rootkit                                             [ Not found ]
    SHV5 Rootkit                                             [ Not found ]
    Sin Rootkit                                              [ Not found ]
    Slapper Worm                                             [ Not found ]
    Sneakin Rootkit                                          [ Not found ]
    Suckit Rootkit                                           [ Not found ]
    SunOS Rootkit                                            [ Not found ]
    SunOS / NSDAP Rootkit                                    [ Not found ]
    Superkit Rootkit                                         [ Not found ]
    TBD (Telnet BackDoor)                                    [ Not found ]
    TeLeKiT Rootkit                                          [ Not found ]
    T0rn Rootkit                                             [ Not found ]
    Trojanit Kit                                             [ Not found ]
    Tuxtendo Rootkit                                         [ Not found ]
    URK Rootkit                                              [ Not found ]
    VcKit Rootkit                                            [ Not found ]
    Volc Rootkit                                             [ Not found ]
    X-Org SunOS Rootkit                                      [ Not found ]
    zaRwT.KiT Rootkit                                        [ Not found ]

  Performing additional rootkit checks
    Checking for possible rootkit files and directories      [ None found ]
    Checking for possible rootkit strings                    [ None found ]

  Performing malware checks
    Checking running processes for suspicious files          [ None found ]
    Checking for login backdoors                             [ None found ]
    Checking for suspicious directories                      [ None found ]
    Checking for sniffer log files                           [ None found ]

  Performing trojan specific checks
    Checking for enabled inetd services                      [ Warning ]
    Checking for Apache backdoor                             [ Not found ]

  Performing FreeBSD specific checks
sockstat: struct xtcpcb size mismatch
sockstat: struct xinpcb size mismatch
sockstat: struct xunpcb size mismatch
sockstat: struct xunpcb size mismatch
    Checking sockstat and netstat commands                   [ Warning ]
    Checking for KLD backdoors                               [ OK ]
[Updating the pkgdb  in /var/db/pkg ... - 141 packages found (-0 +1) . done]
/usr/ports/INDEX-7.bz2                        100% of 1203 kB  196 kBps
done
[Updating the portsdb  in /usr/ports ... - 19545 port entries found .........1000.........2000.........3000.........4000.........5000.........6000.........7000.........8000.........9000.........10000.........11000.........12000.........13000.........14000.........15000.........16000.........17000.........18000.........19000..... ..... done]
    Checking package database                                [ Warning ]

[Press  to continue]

Checking the network...

  Performing check for backdoor ports
    Checking for UDP port 2001                               [ Not found ]
    Checking for TCP port 2006                               [ Not found ]
    Checking for TCP port 2128                               [ Not found ]
    Checking for TCP port 14856                              [ Not found ]
    Checking for TCP port 47107                              [ Not found ]
    Checking for TCP port 60922                              [ Not found ]

  Performing checks on the network interfaces
    Checking for promiscuous interfaces                      [ None found ]

[Press  to continue]


Checking the local host...

  Performing system boot checks
    Checking for local host name                             [ Found ]
    Checking for local startup files                         [ Found ]
    Checking local startup files for malware                 [ None found ]
    Checking system startup files for malware                [ None found ]

  Performing group and account checks
    Checking for passwd file                                 [ Found ]
    Checking for root equivalent (UID 0) accounts            [ None found ]
    Checking for passwordless accounts                       [ None found ]
    Checking for passwd file changes                         [ None found ]
    Checking for group file changes                          [ None found ]
    Checking root account shell history files                [ OK ]

  Performing system configuration file checks
    Checking for SSH configuration file                      [ Found ]
    Checking if SSH root access is allowed                   [ Warning ]
    Checking if SSH protocol v1 is allowed                   [ Not allowed ]
    Checking for running syslog daemon                       [ Found ]
    Checking for syslog configuration file                   [ Found ]
    Checking if syslog remote logging is allowed             [ Not allowed ]

  Performing filesystem checks
    Checking /dev for suspicious file types                  [ None found ]
    Checking for hidden files and directories                [ None found ]

Checking application versions...

    Checking version of Exim MTA                             [ OK ]
    Checking version of Bind DNS                             [ OK ]
    Checking version of OpenSSL                              [ OK ]
    Checking version of PHP                                  [ OK ]
    Checking version of OpenSSH                              [ OK ]


System checks summary
=====================

File properties checks...
    Required commands check failed
    Files checked: 109
    Suspect files: 0

Rootkit checks...
    Rootkits checked : 109
    Possible rootkits: 0

Applications checks...
    Applications checked: 5
    Suspect applications: 0

The system checks took: 3 minutes and 5 seconds

All results have been written to the logfile (/var/log/rkhunter.log)

One or more warnings have been found while checking the system.
Please check the log file (/var/log/rkhunter.log)

Diatas adalah hasil pemeriksaan system dengan rkhunter. Terdeteksi beberapa hal yang kemudian mentriger alarm “warning”.
Tetapi anda jangan langsung panik. Kadang peringatan tersebut adalah false positif dimana mungkin saja kita memang menginginkan fungsi tersebut untuk aktif.
Contoh diatas adalah SSH root access allowed yang diberi peringatan adalah atas sepengetahuan saya (karena ada keperluan dengan ssh root access).
Jadi sekarang rajin-rajin lah scan supaya anda tidak kecolongan kalau ada orang yang iseng-iseng berusaha menanam sesuatu di server anda :).