How To Install, Configure & Run Malware Detect (maldet) On Linux Server

Previously, we talked about a bunch of anti malware for GNU/Linux servers. That list essentially was for the purpose of our future guides around those softwares. Here is a step by step complete guide on how to install, configure & run malware detect (maldet) on linux server with Ubuntu server commands as example. Reader needs not much experience to get used and work.

Again – Linux Malware Detect is a malware scanner for Linux which is designed to find threats faced in shared environments, which includes cloud server. It uses threat data from network edge intrusion detection systems to extract malware that is actively being used in attacks, threat data is also derived from user submissions and from the malware community resources. They are also easily exported to any number of detection tools such as ClamAV. We can actually integrate with ClamAV mentioned in the list linked above.

How To Install, Configure & Run Malware Detect (maldet) On Linux Server

It is actually very easy to use :

The configuration file of Malware Detect (maldet) is located at /usr/local/maldetect/conf.maldet. You can also read the doc at /usr/local/src/maldetect-ver.si.on/README for further instructions. Here we go :

This is an example configuration :

quarantine_hits is the default quarantine action for malware hits where 0 value is alert only, 1 value is to move to quarantine & alert.
quarantine_clean will let you decide whether you want to clean string-based malware injections.
quarantine_suspend_user is the default suspend action for users with malware. It can be a compromised process.
clamav_scan=1 is for configuring the attempt to detect installed ClamAV binary and use as default engine. This makes the system to do faster scan and superior analysis.

To update the library of malware detection signatures, we need to run:

To update Malware Detect’s malware version:

To scan all the files residing in a specific directory:

Please note that, to scan all the files from / location will take hours to complete that is the reason why we run it in a separate screen session so that we can detach and enter to screen session any time and check the status frequently. After the scan complete. You will get a result as shown below :

We can run :

Take 051913-1142.20920 as SCANID. We can write the commands in this format :

To move all the threats that Linux Malware Detect has identified into quarantine:

If you want to actively monitor specific directories for malware infection as a daemon you can combine with inotify-tools to run live monitor :

Rest you’ll get from readme. The software itself will drop the auto scan file to /etc/cron.daily/maldet which will perform a daily update of signatures and keep the session, temp and quarantine data upto 14 days, run a daily scan of recent file system changes.

How To Integrate Malware Detect (maldet) With CalmAV

Only install CalmAV :

And configure /usr/local/maldetect/conf.maldet as written in above configuration direction.