Installing and configuring Maldet

Linux Malware Detect (LMD), also known as Maldet, is a free Linux security tool used to scan systems for malware. It is commonly deployed in hosting environments and identifies threats using signatures from security systems, user reports, and known malware databases.

To install Maldet

1. Change the current directory to /usr/local/src using the command below. You may use a different directory if you prefer to download the installation script elsewhere.

   cd /usr/local/src

2. Run the following command to download the archive file.

   wget https://www.rfxn.com/downloads/maldetect-current.tar.gz

3. Run the command below to extract the files:

   tar -xzf maldetect-current.tar.gz

4. Run the command below to access the Maldet directory.

   cd maldetect-*

5. Run the installation script:

   sh ./install.sh

Sample Output:

Linux Malware Detect v1.3.4
(C) 1999-2010, R-fx Networks
(C) 2010, Ryan MacDonald
inotifywait (C) 2007, Rohan McGovern


This program may be freely redistributed under the terms of the GNU GPL

installation completed to /usr/local/maldetect
config file: /usr/local/maldetect/conf.maldet
exec file: /usr/local/maldetect/maldet
exec link: /usr/local/sbin/maldet
cron.daily: /etc/cron.daily/maldet
maldet(32517): {sigup} performing signature update check…
maldet(32517): {sigup} local signature set is version 2010051510029
maldet(32517): {sigup} latest signature set already [email protected]>@r-fx.org>@r-fx.org>

To configure LMD

By default, all options are fully commented in the configuration file (/usr/local/maldetect/conf.maldet). You can configure them as per your requirement. Various options are listed below:

• email_alert: Set it to 1 to receive email alerts.

• email_subj: Specify your email subject.

• email_addr: Add your email address to receive malware alerts.

• quar_hits: This is the default quarantine action for malware hits and should be set to 1.

• quar_clean: This is the cleaning action for detected malware injections and should be set to 1.

• quar_susp: This is the default suspend action for users with hits. Set it as per your requirement.

• quar_susp_minuid: Minimum userid that can be suspended.

You can update Maldet, using the command:

maldet -u or maldet -d

 
To Scan using Maldet

• To scan the files of a particular user, use the command:

  maldet -a /home/username/

• To scan all users under /home/public_html, use the command:

  maldet –scan-all /home?/?/public_html

• To attempt a clean on all malware results from a previous scan that did not have the feature enabled, use the command:

  maldet –clean SCANID