Before configuring email alerts, ensure you have:

• CentOS 7 installed.
• Rootkit Hunter installed and configured.
• Access to an email server (local or remote) capable of sending emails.

Installing Rootkit Hunter

If you haven't installed Rootkit Hunter yet, you can do so using the following command:

sudo yum install rkhunter

Configuring Email Alerts

1. Editing rkhunter.conf Configuration File

The configuration file for rkhunter is typically located at /etc/rkhunter.conf. Use your preferred text editor to edit this file:

sudo nano /etc/rkhunter.conf

2. Setting Email Address for Alerting

In the configuration file, find or add the following line, replacing This email address is being protected from spambots. You need JavaScript enabled to view it. with the email address where you want to receive alerts:

MAIL-ON-WARNING=This email address is being protected from spambots. You need JavaScript enabled to view it.

3. Configuring SMTP Server

If the email server you'll use for sending alerts is on a different machine or requires authentication, you'll need to configure sendmail or an alternative Mail Transfer Agent (MTA) like Postfix to use this server. Here's an example configuration for Postfix:

• Install Postfix:

  sudo yum install postfix
  sudo systemctl enable postfix
  sudo systemctl start postfix
  ​

• Edit /etc/postfix/main.cf to set relayhost to your SMTP server:

  relayhost = [smtp.yourserver.com]:587
  ​

• For SMTP authentication, edit /etc/postfix/sasl_passwd and add:

  [smtp.yourserver.com]:587 your_user:your_password
  ​

• After configuring, restart Postfix:

  sudo systemctl restart postfix
  ​

 

Testing Configuration

After completing the configuration, it's important to perform a test to ensure email alerts are working correctly. This can be done by running rkhunter with the --check option:

sudo rkhunter --check

By setting up email alerts for Rootkit Hunter, you enhance the security of your system by being promptly informed of potential threats. Remember, regular updates to rkhunter and your system are crucial for maintaining security.