Install and set up rootcheck   IMPORTANT NOTE:  This document is based on CentOS, RedHat Linux 7.3 and Enterprise.  The concepts should be similar across operating systems, but the commands will very likely be different.  Also, never assume the directory structures exist in your system as written in the document.  Never blindly follow security instructions -- read, review, compare, apply as it fits your system. Log into each server as root. Do the following steps: mkdir /usr/local/src cd /usr/local/src rm -f rootcheck-*.tar.gz fetch http://www.ossec.net/rootcheck/files/rootcheck-2.0.tar.gz gzip -d -c rootcheck-2.0.tar.gz | gtar xvf - rm -f rootcheck ln -s /usr/local/src/rootcheck-2.0 /usr/local/src/rootcheck cd rootcheck-2.0 make all ./ossec-rootcheck Handle any infections noted (on a fresh install on a fresh system there should be none). Now set up chkrootkit to run in cron: crontab -e (scroll to bottom) o (lower case o to open a new line) ### Security check at 3:09 AM (ENTER) 9 3 * * * (cd /usr/local/src/rootcheck; ./ossec-rootcheck | mail -s "[PUT IN MEAINGFUL SERVER NAME] ossec-rootcheck output" [VALID EMAIL ADDRESS]) Shift ZZ to save Please be sure to replace the [MEAINGFUL SERVER NAME] with a proper server name, and [VALID EMAIL ADDRESS] with a valid email address. IMPORTANT NOTE:  This document and all linked document is being provided as a good will gesture to the Parallels H-Sphere community and to others who may benefit from its use.  Dynamic Net, Inc. makes no representations implied or explicit as to their value or warranty. Dynamic Net, Inc. will not be held liable for any damage resulting in the application of the steps and procedures noted.  If you feel uncomfortable at all about doing any of the steps, make a complete system backup and hire a third party like We Manage Servers to do the work for you.