 | This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "Chkrootkit" – news · newspapers · books · scholar · JSTOR (September 2011) (Learn how and when to remove this message) |
 chkrootkit on Linux | |
| Developer(s) | Nelson Murilo Klaus Steding-Jessen |
|---|---|
| Stable release | 0.57 / Jan 13 2023 |
| Repository | |
| Operating system | Linux, FreeBSD, OpenBSD, NetBSD, Solaris, HP-UX, Tru64, BSD/OS, Mac OS X |
| Type | Rootkit Detector |
| Website | www |
Chkrootkit (Check Rootkit) is a widely used Unix-based utility designed to aid system administrators in examining their systems for rootkits. Operating as a shell script, it leverages common Unix/Linux tools such as the strings and grep command. The primary purpose is to scan core system programs for identifying signatures and to compare data obtained from traversal the /proc with the output derived from the ps (process status) command, aiming to identify inconsistencies. It offers flexibility in execution, allowing it to function from a rescue disc, often a live CD, and provides an optional alternative directory for executing its commands. These approaches enhance chkrootkit's reliance on the commands it employs.
It's crucial to recognize the inherent limitations of any program that strives to detect compromises, including rootkits and malware. Modern rootkits might deliberately attempt to identify and target copies of the chkrootkit program, or adopt other strategies to elude detection by it.
See also
- Host-based intrusion detection system comparison
- Hardening (computing)
- Linux malware
- MalwareMustDie
- rkhunter
- Lynis
- OSSEC
- Samhain (software)
References
- "chkrootkit -- locally checks for signs of a rootkit". www.chkrootkit.org. Retrieved 2023-09-22.