CENTOS 6.3 安装 Linux Malware Detect (LMD) 及使用教程

前言

最近有客户的站点被注入了有害代码导致网站无法正常运行，甚至对外狂发垃圾邮件等，造成了很严重的影响，究其原因无外乎就是对站点安全性不够重视，更有甚者后台密码都还是诸如 123456 之类的，出了问题了就急匆匆的找来要求解决，跟其解释也听不进去，感觉只要是谁开发的站点，谁就要负责一辈子到底，让人实在汗颜，好了，闲话少说，言归正传，这篇文章我们来重点尝试在CENTOS 6.3底下如何安装病毒检测软件，有人可能会有疑虑，LINUX不是号称超级安全吗，怎么也要杀毒软件，这里简单解释一下，事实上LINUX系统自身感染病毒的几率几乎可以忽略不计，主要感染病毒的是由于放置在该服务器上的开源代码的漏洞导致的，比如版本很久没升级了的WordPress或者一些国内的BBS开源代码，使用人群很庞大，一旦旧版本中有了漏洞，就极易被黑客注入有害代码，所以我们这里要谈的是针对类似网站被黑以后的处理方法。

什么是 Linux Malware Detect (LMD)?

Linux Malware Detect (LMD) 是一个用于Unix/Linux操作系统上的开源病毒检测软件，以GNU GPLv2的方式发布软件版本，一般用于虚拟主机环境的病毒检测和查杀，更多详情请点击 .

如何安装？

# cd /tmp
# wget 
# tar xfz maldetect-current.tar.gz
# cd maldetect-*
# ./install.sh

# cd /tmp

# wget

# tar xfz maldetect-current.tar.gz

# cd maldetect-*

# ./install.sh

如何配置?

vim /usr/local/maldetect/conf.maldet

1	vim /usr/local/maldetect/conf.maldet

基本配置样例如下：

# [ EMAIL ALERTS ]
##
# The default email alert toggle
# [0 = disabled, 1 = enabled]
email_alert=1

# The subject line for email alerts
email_subj="maldet alert from $(hostname)"

# The destination addresses for email alerts
# [ values are comma (,) spaced ]
email_addr="tecmint.com@gmail.com"

# Ignore e-mail alerts for reports in which all hits have been cleaned.
# This is ideal on very busy servers where cleaned hits can drown out
# other more actionable reports.
email_ignore_clean=0

##
# [ QUARANTINE OPTIONS ]
##
# The default quarantine action for malware hits
# [0 = alert only, 1 = move to quarantine & alert]
quar_hits=1

# Try to clean string based malware injections
# [NOTE: quar_hits=1 required]
# [0 = disabled, 1 = clean]
quar_clean=1

# The default suspend action for users wih hits
# Cpanel suspend or set shell /bin/false on non-Cpanel
# [NOTE: quar_hits=1 required]
# [0 = disabled, 1 = suspend account]
quar_susp=0
# minimum userid that can be suspended
quar_susp_minuid=500

# [ EMAIL ALERTS ]

# The default email alert toggle

# [0 = disabled, 1 = enabled]

email_alert=1

# The subject line for email alerts

email_subj="maldet alert from $(hostname)"

# The destination addresses for email alerts

# [ values are comma (,) spaced ]

email_addr="tecmint.com@gmail.com"

# Ignore e-mail alerts for reports in which all hits have been cleaned.

# This is ideal on very busy servers where cleaned hits can drown out

# other more actionable reports.

email_ignore_clean=0

# [ QUARANTINE OPTIONS ]

# The default quarantine action for malware hits

# [0 = alert only, 1 = move to quarantine & alert]

quar_hits=1

# Try to clean string based malware injections

# [NOTE: quar_hits=1 required]

# [0 = disabled, 1 = clean]

quar_clean=1

# The default suspend action for users wih hits

# Cpanel suspend or set shell /bin/false on non-Cpanel

# [NOTE: quar_hits=1 required]

# [0 = disabled, 1 = suspend account]

quar_susp=0

# minimum userid that can be suspended

quar_susp_minuid=500

扫描病毒：

maldet --scan-all /home

1	maldet --scan-all /home

获得报告：

maldet --report 032813-1606.27752

1	maldet --report 032813-1606.27752

清除病毒

maldet -q 032813-1606.27752

1	maldet -q 032813-1606.27752

修改计划任务配置：

vim /etc/cron.daily/maldet

1	vim /etc/cron.daily/maldet

参考网站：

参考网址1：

参考网址2：