Category Archives: Linux

Security – Detecting malware in Linux.

This tool is provided by R-fx Networks.

[mythcat@desk ~]$ wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
[mythcat@desk ~]$ tar -xf maldetect-current.tar.gz 
[mythcat@desk ~]$ cd maldetect-1.6.4/
[mythcat@desk maldetect-1.6.4]$ su
Password: 
[root@desk maldetect-1.6.4]# ./install.sh
Failed to enable unit: Unit file maldet.service does not exist.
Linux Malware Detect v1.6.4
            (C) 2002-2019, R-fx Networks <proj@r-fx.org>
            (C) 2019, Ryan MacDonald <ryan@r-fx.org>
This program may be freely redistributed under the terms of the GNU GPL

installation completed to /usr/local/maldetect
config file: /usr/local/maldetect/conf.maldet
exec file: /usr/local/maldetect/maldet
exec link: /usr/local/sbin/maldet
exec link: /usr/local/sbin/lmd
cron.daily: /etc/cron.daily/maldet
maldet(31046): {sigup} performing signature update check...
maldet(31046): {sigup} local signature set is version 201907043616
maldet(31046): {sigup} new signature set 2019081912001 available
maldet(31046): {sigup} downloading https://cdn.rfxn.com/downloads/maldet-sigpack.tgz
maldet(31046): {sigup} downloading https://cdn.rfxn.com/downloads/maldet-cleanv2.tgz
maldet(31046): {sigup} verified md5sum of maldet-sigpack.tgz
maldet(31046): {sigup} unpacked and installed maldet-sigpack.tgz
maldet(31046): {sigup} verified md5sum of maldet-clean.tgz
maldet(31046): {sigup} unpacked and installed maldet-clean.tgz
maldet(31046): {sigup} signature set update completed
maldet(31046): {sigup} 15552 signatures (12740 MD5 | 2035 HEX | 777 YARA | 0 USER)
[root@desk maldetect-1.6.4]# vim /usr/local/maldetect/conf.maldet

[mythcat@desk ~]$ wget http://www.rfxn.com/downloads/maldetect-current.tar.gz

[mythcat@desk ~]$ tar -xf maldetect-current.tar.gz

[mythcat@desk ~]$ cd maldetect-1.6.4/

[mythcat@desk maldetect-1.6.4]$ su

Password:

[root@desk maldetect-1.6.4]# ./install.sh

Failed to enable unit: Unit file maldet.service does not exist.

Linux Malware Detect v1.6.4

This program may be freely redistributed under the terms of the GNU GPL

installation completed to /usr/local/maldetect

config file: /usr/local/maldetect/conf.maldet

exec file: /usr/local/maldetect/maldet

exec link: /usr/local/sbin/maldet

exec link: /usr/local/sbin/lmd

cron.daily: /etc/cron.daily/maldet

maldet(31046): {sigup} performing signature update check...

maldet(31046): {sigup} local signature set is version 201907043616

maldet(31046): {sigup} new signature set 2019081912001 available

maldet(31046): {sigup} downloading https://cdn.rfxn.com/downloads/maldet-sigpack.tgz

maldet(31046): {sigup} downloading https://cdn.rfxn.com/downloads/maldet-cleanv2.tgz

maldet(31046): {sigup} verified md5sum of maldet-sigpack.tgz

maldet(31046): {sigup} unpacked and installed maldet-sigpack.tgz

maldet(31046): {sigup} verified md5sum of maldet-clean.tgz

maldet(31046): {sigup} unpacked and installed maldet-clean.tgz

maldet(31046): {sigup} signature set update completed

maldet(31046): {sigup} 15552 signatures (12740 MD5 | 2035 HEX | 777 YARA | 0 USER)

[root@desk maldetect-1.6.4]# vim /usr/local/maldetect/conf.maldet

Change this row to scan_user_access=1 Now you can run it:

[mythcat@desk ~]$ /usr/local/sbin/maldet -a

1	[mythcat@desk ~]$ /usr/local/sbin/maldet -a

SELinux – Commonly used commands.

In the last tutorial I wrote about two commands: chcon and restorecon. Today I will show you one list with some of the more commonly used command-line utilities for managing and operating SELinux provided by utilities: by policycoreutils package: fixfiles: Fixes the security context on file systems load_policy: Loads a new SELinux policy into the… Read More »

SELinux – Change context.

Processes and files are labeled with an SELinux context that contains additional information, such as an SELinux user, role, type, and, optionally, a level. When running SELinux, all of this information is used to make access control decisions. Let’s test this with httpd sercice and index.html file. You need to start this service on Fedora.… Read More »

Linux – How to test Slax 9.9.0 released with QEMU.

The new Slax version 9.9 was released just a few seconds ago. It contains updates for all core packages, most noticeable is the update of Chromium web browser, which added 10 MB to the total ISO size for no apparent reason, unfortunately, there is nothing we could do about it. Next version of Slax is… Read More »

Linux – commands to clear RAM cache and Swap space.

The Linux System has three options to clear cache without interrupting any processes or services. To clear all PageCache, entries, and inodes you need to use something like:

# sync; echo 3 > /proc/sys/vm/drop_caches

1	# sync; echo 3 > /proc/sys/vm/drop_caches

The drop_caches file can be changed by echo command with these numbers: 1,2 and 3. To clear the Swap space, you may like to run the… Read More »