How To Install Chkrootkit on CentOS Stream 10

Securing your Linux server against sophisticated threats is an ongoing challenge for system administrators. Rootkits represent one of the most insidious security threats, designed to hide malicious activity while maintaining privileged access to your system. Chkrootkit stands as a powerful defensive tool in this constant battle, offering comprehensive scanning capabilities to detect potential rootkit infections on your CentOS Stream 10 system. In this guide, we’ll walk through the complete process of installing, configuring, and optimizing Chkrootkit to enhance your server’s security posture.

Understanding Rootkits and System Security

Rootkits are collections of software tools that enable unauthorized users to gain administrator-level access to a computer system while concealing their presence. Unlike typical malware that may announce itself through system slowdowns or obvious behavior changes, rootkits operate covertly by modifying system files and processes.

The term “rootkit” combines “root” (the traditional name for the privileged account on Unix-like systems) with “kit” (referring to the software components that implement the tool). These malicious tools typically fall into several categories:

• Kernel rootkits modify the operating system’s kernel, making them extremely difficult to detect
• User-mode rootkits replace system binaries with malicious versions
• Bootloader rootkits replace the legitimate bootloader with a compromised version
• Memory-based rootkits operate exclusively in system memory, leaving no traces on disk

On CentOS Stream 10, rootkits might exploit vulnerabilities through various attack vectors, including compromised applications, outdated system software, weak passwords, or social engineering tactics. What makes rootkit detection particularly challenging is their ability to manipulate the very tools system administrators typically use to identify security issues.

This is where specialized tools like Chkrootkit become invaluable. By comparing known rootkit signatures against your system files and looking for suspicious behaviors, Chkrootkit provides a critical layer of security monitoring that complements CentOS Stream 10’s built-in protections.

About CentOS Stream 10 and Security Considerations

CentOS Stream 10 represents the latest iteration in the CentOS ecosystem, functioning as the upstream development platform for Red Hat Enterprise Linux (RHEL). As a rolling-release distribution, it offers a balance between stability and access to newer packages, making it popular for server environments.

From a security perspective, CentOS Stream 10 inherits many robust security features from its RHEL foundations, including SELinux (Security-Enhanced Linux) for mandatory access controls, firewalld for network security, and regular security updates. However, these native protections, while substantial, aren’t comprehensive against all threats—particularly the stealthy nature of rootkits.

Chkrootkit complements CentOS Stream 10’s security framework by providing specialized rootkit detection capabilities. While SELinux can prevent certain unauthorized actions, Chkrootkit specifically looks for signs of existing rootkit compromises, examining critical system files and processes for suspicious modifications or behaviors. This makes it an essential addition to your security toolkit, especially for servers exposed to the internet or those hosting sensitive data.

Prerequisites for Installing Chkrootkit

Before proceeding with Chkrootkit installation on your CentOS Stream 10 system, ensure you have the following prerequisites in place:

• A CentOS Stream 10 system with root or sudo privileges
• Adequate disk space (at least 100MB for installation files and logs)
• Basic command-line knowledge
• Internet connectivity for downloading packages
• Development tools for source code compilation (if installing from source)

To verify your CentOS Stream 10 version, run:

cat /etc/centos-release

Additionally, you’ll need several development packages for the source installation method. These will be detailed in the preparation section below.

Installation Methods Comparison

There are two primary methods for installing Chkrootkit on CentOS Stream 10: repository installation and source code installation. Each approach has distinct advantages and considerations.

Repository Installation:

• Pros: Simpler installation process, automatic updates through your package manager, easier dependency resolution
• Cons: May not provide the latest version of Chkrootkit, limited configuration options during installation

Source Code Installation:

• Pros: Access to the latest version with newest detection capabilities, greater control over the installation process, ability to review the code before installation
• Cons: More complex installation steps, manual updates required, potential compilation issues

For CentOS Stream 10 deployments in production environments, the source installation method is generally recommended despite its additional complexity. This approach ensures you have the most recent detection signatures and fixes, critical for identifying the latest rootkit threats. However, if simplicity is your priority, the repository method provides a functional installation with minimal effort.

Preparing Your CentOS Stream 10 System

Before installing Chkrootkit, it’s essential to prepare your system by updating existing packages and installing necessary dependencies. This preparation ensures a smooth installation process and optimal functionality.

First, update your system packages to their latest versions:

sudo dnf update -y

Next, install the required development tools and dependencies for compiling Chkrootkit:

sudo dnf install -y gcc make glibc-static wget tar
sudo dnf groupinstall "Development Tools" -y

These packages provide the essential compilers and utilities needed to build Chkrootkit from source. The glibc-static package is particularly important as it provides static libraries required during compilation.

Create a directory for downloading and compiling the source code:

mkdir -p ~/chkrootkit-install
cd ~/chkrootkit-install

With these preparations complete, your CentOS Stream 10 system is ready for Chkrootkit installation.

Step-by-Step Source Installation Guide

Installing Chkrootkit from source ensures you have the latest version with the most up-to-date rootkit detection capabilities. Follow these detailed steps to install Chkrootkit on your CentOS Stream 10 system:

1. Download the Latest Chkrootkit Package

First, retrieve the latest Chkrootkit source code from the official website:

wget ftp://chkrootkit.org/pub/seg/pac/chkrootkit.tar.gz

2. Verify the Downloaded Package

While optional, verifying the integrity of the downloaded file is recommended for security purposes. Check the MD5 or SHA256 sum if available on the Chkrootkit website:

md5sum chkrootkit.tar.gz

3. Extract the Archive

Unpack the downloaded tarball to access the source code:

tar -xvzf chkrootkit.tar.gz

This command extracts the contents to a directory named after the Chkrootkit version (e.g., chkrootkit-0.55).

4. Navigate to the Extracted Directory

Move into the newly created directory:

cd chkrootkit-*

The asterisk wildcard ensures you enter the correct directory regardless of the version number.

5. Compile the Source Code

Compile Chkrootkit using the make utility:

make sense

The “sense” target instructs make to build the Chkrootkit binaries appropriate for your system. This process typically takes less than a minute on modern hardware.

6. Verify the Installation

Ensure the compilation was successful by checking the version:

./chkrootkit -V

This should display the version information of the installed Chkrootkit.

7. Move Chkrootkit to a Permanent Location

For better organization and ease of access, move the Chkrootkit files to a standard location:

sudo mkdir -p /usr/local/chkrootkit
sudo cp -R * /usr/local/chkrootkit/

8. Create a Symbolic Link for Convenience

Create a symbolic link to make Chkrootkit easily accessible from anywhere in the system:

sudo ln -s /usr/local/chkrootkit/chkrootkit /usr/local/bin/chkrootkit

With these steps completed, Chkrootkit is now installed on your CentOS Stream 10 system and ready for configuration and use.

Alternative: Repository Installation

While source installation is recommended for the latest features, repository installation offers a simpler approach. Currently, Chkrootkit may not be available in the default CentOS Stream 10 repositories, but you can install it using EPEL (Extra Packages for Enterprise Linux), a trusted repository for additional software.

First, install the EPEL repository if you haven’t already:

sudo dnf install epel-release -y

Once EPEL is enabled, install Chkrootkit using DNF:

sudo dnf install chkrootkit -y

Verify the installation by checking the version:

chkrootkit -V

The repository installation automatically places Chkrootkit in your system path (typically /usr/sbin/chkrootkit), making it immediately available for use. Although this method is simpler, be aware that the repository version might be older than the latest available source version.

Initial Configuration

After installation, configuring Chkrootkit properly ensures optimal performance and accurate scanning results. While Chkrootkit works reasonably well with default settings, certain configurations can enhance its effectiveness for your specific environment.

The main configuration considerations include:

Scan Targets

By default, Chkrootkit scans your entire system. However, you can specify particular directories or exclude certain paths to optimize scanning time. This is especially useful for large servers with multiple mounted filesystems.

Logging Options

Configure how Chkrootkit logs its findings by specifying output files and log rotation settings. This ensures you maintain a history of scans for security auditing purposes.

Notification Settings

Set up email notifications to alert administrators when suspicious activities are detected.

To create a basic configuration, create a dedicated configuration directory:

sudo mkdir -p /etc/chkrootkit

Create a simple configuration file:

sudo nano /etc/chkrootkit/chkrootkit.conf

Add the following basic configuration:

# Chkrootkit configuration file

# Directories to exclude from scanning (space-separated)
EXCLUDE_DIRS="/proc /sys /dev /media /mnt"

# Enable quiet mode (only show infected results)
RUN_DAILY_OPTS="-q"

# Email address for notifications
NOTIFY_EMAIL="admin@yourdomain.com"

Save the file and exit the editor. This configuration provides a starting point that you can expand based on your specific needs.

Running Your First Scan

With Chkrootkit installed and configured, it’s time to run your first rootkit scan. This initial scan establishes a baseline for your system and helps identify any existing security issues.

Basic Scan

To run a basic scan with default options, execute:

sudo chkrootkit

This command scans your entire system and displays results in real-time. Be patient, as a complete scan may take several minutes depending on your system size and performance.

Running a Quiet Mode Scan

To receive alerts only for detected issues (reducing noise from clean results):

sudo chkrootkit -q

The quiet mode is particularly useful for automated scans where you only want to be notified of potential problems.

Excluding Specific Directories

To exclude certain directories from scanning (useful for large mounted filesystems or virtual machine images):

sudo chkrootkit -e "/proc /sys /dev /media /mnt"

This command prevents Chkrootkit from scanning the specified directories, potentially reducing scan time and false positives.

During the scan, Chkrootkit examines various aspects of your system, including:

• System binaries for modifications
• Kernel modules for suspicious entries
• Network interfaces for promiscuous mode
• Hidden processes and files
• Common rootkit signatures

The resource usage during a scan is generally moderate, with CPU usage spiking temporarily during intensive checks. On most modern servers, you shouldn’t notice significant performance impacts during scanning.

Understanding Scan Results

Interpreting Chkrootkit scan results correctly is crucial for distinguishing between genuine threats and false positives. The output format includes various checks with their corresponding status.

Typical Output Elements

A clean scan typically shows “nothing found” or “not infected” for each tested component:

Checking `amd'... not found
Checking `basename'... not infected
Checking `biff'... not found

When Chkrootkit detects a potential issue, it displays “INFECTED” or a specific warning message:

Checking `tcpd'... INFECTED
Checking `sniffer'... eth0: PACKET SNIFFER(/lib/systemd/systemd-networkd[536])

Common False Positives

It’s important to understand that Chkrootkit can produce false positives in several scenarios:

1. Process Hidden Warnings: Messages about hidden processes often occur with short-lived processes that complete between Chkrootkit’s different detection phases. This is particularly common with containerized applications or automated system tasks.
2. “Possible LKM Trojan” Warning: This common false positive appears on many modern Linux systems due to how the kernel handles process visibility. To verify if this is a false positive, use tools like ps, lsof, or atop to investigate the processes in question.
3. Network Interface Warnings: Alerts about interfaces in promiscuous mode may legitimately appear on systems running network monitoring tools, packet analyzers, or certain virtualization components.

When Chkrootkit reports a potential issue, don’t panic immediately. Instead, investigate further using additional tools and techniques:

# Check process details
ps aux | grep [suspicious_process_id]

# Examine file integrity
sudo rpm -V [package_containing_suspicious_file]

# Look for unexpected network connections
sudo netstat -tulpn | grep [suspicious_port_or_process]

Document all scan results and your verification steps for future reference. Establishing a baseline of normal behaviors on your specific system helps distinguish between genuine threats and expected behaviors in future scans.

Setting Up Automated Scanning

Regular scanning is essential for effective security monitoring. Setting up automated Chkrootkit scans ensures consistent protection without manual intervention.

Creating a Cron Job

The most common method for automating Chkrootkit scans is using cron. Create a daily scan by adding an entry to the system’s crontab:

sudo crontab -e

Add the following line to run Chkrootkit daily at 3 AM:

0 3 * * * /usr/local/bin/chkrootkit -q 2>&1 | mail -s "Chkrootkit Report: $(hostname)" admin@yourdomain.com

This command runs Chkrootkit in quiet mode and emails the results to the specified address.

Creating a Dedicated Script

For more complex automation, create a dedicated script:

sudo nano /etc/cron.daily/chkrootkit-scan

Add the following content:

#!/bin/bash

# Chkrootkit daily scan script for CentOS Stream 10
# Created: $(date +%Y-%m-%d)

# Log file location
LOG_FILE="/var/log/chkrootkit/daily-scan-$(date +%Y-%m-%d).log"
LOG_DIR=$(dirname "$LOG_FILE")

# Create log directory if it doesn't exist
mkdir -p "$LOG_DIR"

# Run Chkrootkit with options
/usr/local/bin/chkrootkit -q > "$LOG_FILE" 2>&1

# Check if there are any INFECTED or WARNING messages
if grep -E 'INFECTED|WARNING' "$LOG_FILE" > /dev/null; then
    # Send email notification only if issues found
    mail -s "ALERT: Chkrootkit detected potential issues on $(hostname)" admin@yourdomain.com < "$LOG_FILE"
    exit 1
fi

# Rotate logs (keep last 7 days)
find "$LOG_DIR" -name "daily-scan-*.log" -type f -mtime +7 -delete

exit 0

Make the script executable:

sudo chmod +x /etc/cron.daily/chkrootkit-scan

This script runs daily, logs the results, alerts administrators only when potential issues are detected, and automatically rotates logs to manage disk space.

Advanced Configuration Options

Once you’re comfortable with basic Chkrootkit operation, consider these advanced configuration options to enhance your security monitoring:

Excluding Known False Positives

Create a custom exclusion list to prevent recurring false positives:

sudo chkrootkit -e "/path/to/known/false/positive /another/false/positive"

You can add these exclusions to your automated scan script to reduce noise.

Integrating with Security Information and Event Management (SIEM)

For enterprise environments, integrate Chkrootkit with your SIEM system by forwarding logs:

# Add to your scan script
/usr/local/bin/chkrootkit | logger -t chkrootkit

This command sends Chkrootkit output to syslog, where it can be collected by SIEM solutions.

Performance Optimization

Customize scanning parameters to balance thoroughness with system performance:

1. Limit scanning to critical directories:

   sudo chkrootkit /bin /sbin /usr/bin /usr/sbin /lib /usr/lib

2. Schedule scans during low-usage periods:
   Adjust your cron schedule to run during off-peak hours.
3. Set resource limits:
   Use the nice and ionice commands to reduce CPU and I/O impact:

   nice -n 19 ionice -c 3 chkrootkit

Custom Detection Rules

For advanced users, create custom detection rules by modifying configuration files in the Chkrootkit installation directory. This requires detailed knowledge of rootkit behaviors but can be valuable for environments with specific threats or custom software that triggers false positives.

Troubleshooting Common Issues

Even with careful installation and configuration, you may encounter issues with Chkrootkit. Here are solutions to common problems:

Compilation Errors

Issue: Errors during the make sense step.

Solution: Ensure all required development packages are installed:

sudo dnf install gcc make glibc-static glibc-devel

If you encounter specific error messages about missing headers, install the corresponding development packages.

Scan Failures

Issue: Chkrootkit crashes or hangs during scans.

Solutions:

1. Update to the latest version, which may contain fixes.
2. Run with reduced functionality to identify problematic modules:

   sudo chkrootkit -x

3. Check system resources—increase available memory or temporarily stop resource-intensive services.

False Positives

Issue: Excessive false positive alerts.

Solutions:

1. Use the quiet mode (-q) to reduce noise.
2. Exclude known false positive directories using the -e option.
3. Create a baseline scan after a fresh system installation and compare future results against it.
4. Update to the latest version, which may have improved detection accuracy.

Permission Issues

Issue: “Permission denied” errors during scanning.

Solution: Ensure you’re running Chkrootkit with sudo or as the root user, as many checks require elevated privileges to access system files.

Keep a log of troubleshooting steps and their outcomes. This documentation helps identify patterns and speeds up resolution of recurring issues.

Limitations of Chkrootkit

While Chkrootkit is a valuable security tool, understanding its limitations is crucial for maintaining a comprehensive security posture:

1. Detection Method Limitations: Chkrootkit primarily uses signature-based detection, making it less effective against new or unknown rootkits without established signatures.
2. False Positives and Negatives: As discussed earlier, Chkrootkit can generate false positives that require manual verification. More concerning are false negatives—failing to detect actual rootkits that use advanced evasion techniques.
3. Runtime Environment Constraints: Chkrootkit runs within the potentially compromised system it’s checking. Advanced rootkits can detect scanning attempts and hide their presence specifically during scans.
4. Limited Coverage: Some advanced kernel-level rootkits can completely evade detection by userspace tools like Chkrootkit by intercepting and modifying system calls.
5. Static Analysis Nature: Chkrootkit typically performs point-in-time scans rather than continuous monitoring, potentially missing intermittent rootkit activities.

Due to these limitations, security experts recommend using Chkrootkit as one component of a layered security strategy rather than relying on it exclusively for rootkit detection.

Complementary Security Tools

To address Chkrootkit’s limitations and create a more robust security posture, combine it with these complementary tools:

Rkhunter (Rootkit Hunter)

Rkhunter offers an alternative approach to rootkit detection, often catching issues that Chkrootkit might miss:

sudo dnf install rkhunter
sudo rkhunter --update
sudo rkhunter --check

Running both Chkrootkit and Rkhunter provides better coverage through different detection methods.

Lynis

Lynis performs comprehensive security auditing beyond rootkit detection:

sudo dnf install lynis
sudo lynis audit system

This tool helps identify configuration weaknesses that could lead to successful rootkit installations.

AIDE (Advanced Intrusion Detection Environment)

AIDE monitors file integrity, alerting you to unauthorized changes that might indicate rootkit activity:

sudo dnf install aide
sudo aide --init
sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

After initialization, run periodic checks:

sudo aide --check

Auditd

The Linux Audit system provides detailed logging of system events, helping identify suspicious activities:

sudo dnf install audit
sudo systemctl enable auditd
sudo systemctl start auditd

Configure audit rules to monitor critical system calls and file access patterns.

SELinux

Ensure SELinux is properly configured on your CentOS Stream 10 system:

sudo dnf install setroubleshoot setools
sudo sestatus

If not in enforcing mode, consider enabling it:

sudo setenforce 1

And make it persistent:

sudo sed -i 's/SELINUX=permissive/SELINUX=enforcing/' /etc/selinux/config

By combining these tools with Chkrootkit, you create a multi-layered defense system that compensates for individual tool limitations.

Best Practices for System Security Beyond Chkrootkit

While rootkit detection is important, comprehensive system security requires a broader approach. Implement these best practices to enhance your CentOS Stream 10 security posture:

Regular System Updates

Keep your system current with security patches:

sudo dnf update --security

Consider automating updates for critical security fixes:

sudo dnf install dnf-automatic
sudo systemctl enable --now dnf-automatic.timer

Strong User Authentication

Implement strong password policies and consider multi-factor authentication:

sudo dnf install google-authenticator

Disable root login and use sudo for administrative tasks.

Network Security

Configure your firewall to restrict unnecessary access:

sudo dnf install firewalld
sudo systemctl enable firewalld
sudo systemctl start firewalld

Allow only required services:

sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

Service Hardening

Disable unused services to reduce attack surface:

sudo systemctl list-unit-files --type=service
sudo systemctl disable [unnecessary_service]

Regular Backups

Implement systematic backups of critical data:

sudo dnf install rsync

Create a backup script and schedule it with cron for regular execution.

Monitoring and Auditing

Set up comprehensive logging and regular log reviews:

sudo dnf install logwatch

Configure logwatch to send daily reports of system activities.

These practices, combined with tools like Chkrootkit, create a defense-in-depth strategy that significantly improves your security posture.

Real-World Example: Responding to Suspicious Findings

Let’s walk through a scenario where Chkrootkit identifies a potential issue and the steps to investigate and remediate:

Scenario: Suspicious Binary Detection

During a routine Chkrootkit scan, you receive the following alert:

Checking `chsh'... INFECTED

Investigation Steps

1. Verify if it’s a known false positive:
   Research indicates this specific alert is common and often a false positive in CentOS environments.
2. Check the binary’s integrity:

   sudo rpm -V util-linux-core

   If this shows no modifications, the file likely hasn’t been tampered with.

3. Examine file permissions and ownership:

   ls -la $(which chsh)

   Verify these match expected values.

4. Look for unusual processes or connections:

   sudo ps aux | grep -i suspicious
   sudo netstat -tulpn | grep ESTABLISHED

5. Check for unauthorized users or unusual activities:

   last | head
   grep "authentication failure" /var/log/secure

Response Actions

If your investigation confirms a genuine compromise:

1. Isolate the system by disconnecting it from the network.
2. Preserve evidence by creating forensic copies of important files and memory.
3. Determine the entry point by reviewing logs and recent changes.
4. Clean or rebuild depending on the severity—for serious rootkits, complete reinstallation is often safest.
5. Report the incident according to your organization’s security policy and regulatory requirements.
6. Implement preventive measures to address the vulnerability that allowed the initial compromise.

This systematic approach ensures you appropriately respond to Chkrootkit alerts without overreacting to false positives or underestimating genuine threats.

Congratulations! You have successfully installed Chkrootkit. Thanks for using this tutorial for installing the Chkrootkit on CentOS Stream 10 system. For additional help or useful information, we recommend you check the Chkrootkit website.