Skip to main content

Rkhunter Set Up in systemd : Revisited

I made a post about setting up rkhunter using systemd. And little did I know it's going to be a work in progress for weeks. But I have finally set up the service and timer units just right.

[donato@archdesktop ~]$ systemctl list-timers
NEXT                         LEFT        LAST                         PASSED       UNIT                         ACTIVATES
Fri 2017-10-06 00:00:00 +08  16h left    Thu 2017-10-05 00:00:20 +08  7h ago       logrotate.timer              logrotate.service
Fri 2017-10-06 00:00:00 +08  16h left    Thu 2017-10-05 00:00:20 +08  7h ago       man-db.timer                 man-db.service
Fri 2017-10-06 00:00:00 +08  16h left    Thu 2017-10-05 00:00:20 +08  7h ago       shadow.timer                 shadow.service
Fri 2017-10-06 00:00:00 +08  16h left    Thu 2017-10-05 00:00:20 +08  7h ago       updatedb.timer               updatedb.service
Fri 2017-10-06 00:08:16 +08  16h left    Thu 2017-10-05 04:28:45 +08  3h 15min ago rkhunter.timer               rkhunter.service
Fri 2017-10-06 01:38:57 +08  17h left    Wed 2017-10-04 19:12:48 +08  12h ago      systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service
Mon 2017-10-09 08:46:49 +08  4 days left Mon 2017-10-02 19:37:22 +08  2 days ago   reflector.timer              reflector.service

7 timers listed.
Pass --all to see loaded but inactive timers, too.
[donato@archdesktop ~]$ systemctl status rkhunter.service
donato@archdesktop ~]$ systemctl status rkhunter.service
● rkhunter.service - rkhunter rootkit scan and malware detection
   Loaded: loaded (/etc/systemd/system/rkhunter.service; static; vendor preset: disabled)
   Active: inactive (dead)
     Docs: man:rkhunter
           man:systemd.service
[donato@archdesktop ~]$

If I want rkhunter to start scanning at boot, I should enable the service with:

$ systemctl enable rkhunter.service

Since I don't want that behavior I'm disabling the service. It won't start at boot but will start when its timer elapse. 

rkhunter update process fails in this instance, but the main process goes on at the elapse time set in the timer file. My tip with creating service and timer files in systemd is letting the default behavior take you where you want to go. So it's a given that you know what those defaults are.


My current rkhunter.service file is:
[donato@archdesktop ~]$ systemctl cat rkhunter.service
# /etc/systemd/system/rkhunter.service
[Unit]
Description=rkhunter rootkit scan and malware detection
Documentation=man:rkhunter man:systemd.service


[Service]
ExecStartPre=-/usr/bin/rkhunter --update
ExecStartPre=-/usr/bin/rkhunter --propupd
ExecStart=/usr/bin/rkhunter --check -sk
SuccessExitStatus=1 2 8 SIGKILL TERM


[Install]
WantedBy=multi-user.target

My current rkhunter.timer file is:
[donato@archdesktop ~]$ systemctl cat rkhunter.timer
# /etc/systemd/system/rkhunter.timer
[Unit]
Description=Run rkhunter daily
Documentation=man:rkhunter man:systemd.timer


[Timer]
OnCalendar=*-*-* 00:00:00
RandomizedDelaySec=5h
WakeSystem=true
Persistent=true


[Install]
WantedBy=timers.target

Comments

Post a Comment

Popular posts from this blog

Appindicator In Natty Ubuntu 11.04

Previously ranted about the blind alley Ubuntu 11.04 seemed to be leading us when it comes to some applications not being ready yet for the dropping of system tray.  What I should have done is press on. There are posts about editing a white list with a recommended GUI tool to help us out here , here and here . Like everything in Linux, there's a configuration file for it, if you can find it and if you have the inclination to go ninja. If not then there's dconf-editor. Download dconf-tools from Software Center. Navigate to desktop>unity>panel. Add your application in the white list. Then close the window. No save button. mmm. So far I have added Shutter, Dropbox and Keepassx in the white list.                Before...  After.
Post a Comment
Read more

Evolution Mail on GNOME 3.26

There's a slight change in the user interface. A To Do column now appears to the rightmost after the GNOME 3.26 update. Also there's a noticeable stability increase, what with goa-daemon stopping its RAM usage creep. I don't have to kill it every couple of hours.
Post a Comment
Read more

New Converge ICT Plan Max with Sky Now

I pulled the trigger on Converge Max plan 400Mbps with Sky channels. I went to their sales office and asked for the upgrade. No charge at all and they didn't ask me to return the old modem. It looks like they will pull it when they install the new modem.e     It came with a black box for the TV. The configuration is easy but it took me 3 days to figure out the Wired connection. It should be fine except I have to jiggle it in the config (GUI). Turn 802.1x  on and off to finally connect.  Here's the speed for the Wired connection:
Post a Comment
Read more