Hey!
My learning continues with OpenSUSE. Now I need help with the following “problems”.
I have a mix of OpenSUSE and Windows computers in my network, all behind a firewall (Sophus UTM) that uses VPN (through an ASUS router) to access the Internet.
My question is:
How do I configure “rkhunter” to get the best protection on my computer? Automatically if there is a possibility.
How do I do, all configuration tips and referrals are needed and appreciated?
/ Roland
On openSUSE 42.3:
zypper in -y rkhunter
This will install a cronjob as:** /etc/cron.daily/suse.de-rkhunter **
Then edit** /etc/sysconfig/rkhunter**
and change
CRON_DB_UPDATE="no"
to
CRON_DB_UPDATE="yes"
Now you have nightly automated rootkit scans + database updates.
A lot has been written about the limitations of rkhunter.
There are a great many rootkits, and rkhunter is only able to find some.
Better is prevention by understanding what is required to insert a rootkit and addressing those attack vectors, although scanning should not be overlooked depending on your requirements.
TSU