set up cron for chkrootkit

[thelunatic]

hi,
can have help with crontab to run weekly

[kbob]

@Thelunatic

The necessary cron for weekly run is :

0 15 * * 0 /root/chkrootkit-weekly.sh

This will run each Sunday as per instructed, of course you can always change the name of the script if your bash file is elsewhere and it probably is.

Hope this helps you in any way.

[system1351]

Hi man...

i create this script.... i still a few hours to make that.. i am not find that in any site (the combination ha)

you change cron.daily to weekly
nano /etc/cron.daily/rkhunter.sh

then in rkhunter.sh put this code:

#!/bin/bash
(/usr/local/bin/rkhunter --checkversion
/usr/local/bin/rkhunter --update
/usr/local/bin/rkhunter -c -sk
/usr/local/bin/rkhunter --cronjob --report-warnings-only) | mail -s "Server XXX Weekly Report" support@yourdomain.com


then run this (change daily for weekly)
chmod +x /etc/cron.daily/rkhunter.sh

then make a test (change daily for weekly)

sh /etc/cron.daily/rkhunter.sh

[k-planethost]

rkunter has an inderface for cpanel you can set the cron from there.
The Rkhunter WHM Interface » Scriptmantra

[k2tec]

I also tried to setup a cronjob for Chkrootkit-0.49
When I run it manualy it run okay cd /root/chkrootkit-0.49 ==> ./chkrootkit

I Made the cronjob in /etc/cron.daily

#!/bin/bash
cd /root/chkrootkit-0.49/
./chkrootkit | mail -s "chkrootkit Scan." host@myserver.com

but I become this message
/etc/cron.daily/chkrootkit.sh:

/etc/cron.daily/chkrootkit.sh: line 3: mail: command not found

Is there someone with a answer.

Tom

[cPanelTristan]

Change to the path for mail instead:

./chkrootkit | /bin/mail -s "chkrootkit Scan" host@myserver.com

[k2tec]

I changed it to

./chkrootkit | /bin/mail -s "chkrootkit Scan" host@myserver.com

but tested with:

 sh  /etc/cron.daily/chkrootkit.sh

gave me

/etc/cron.daily/chkrootkit.sh: line 3: /bin/mail: No such file or directory

# whereis mail

mail: /etc/mail
but in the mail directory is only spamassassin

[cPanelTristan]

When I do "whereis mail", I show the following:

root@host [~]# whereis mail
mail: /bin/mail /etc/mail.rc /etc/mail /usr/lib/mail.tildehelp /usr/lib/mail.help /usr/share/man/man1/mail.1.gz

Run this command to see the output:

rpm -qa | grep -i mailx

If you show the rpm, then remove it:

rpm -e --nodeps mailx

Now, reinstall it:

yum -y install mailx

After that, check if /bin/mail now exists:

ls -lah /bin/mail

[k2tec]

When I do "whereis mail", I show the following:

Run this command to see the output:

rpm -qa | grep -i mailx

Showed nothing, nothing to remove


reinstalled it:

yum -y install mailx

After that, check if /bin/mail now exists:

ls -lah /bin/mail

shows
lrwxrwxrwx 1 root root 5 Aug 29 18:48 /bin/mail -> mailx

whereis mail shows

mail: /bin/mail /etc/mail /etc/mail.rc /usr/share/man/man1/mail.1.gz

I will look tomorrow if its run these night correct.

Thanks,
Tom

[k2tec]

It Works perfect