Root Kit Detection

Comparing with installed RPM based packages

This is generally only relevant to Red Hat based distributions which use the RPM packaging system.

Boot off a clean disk image and mount the partitions you want to check.

    $ for foo in `rpm -q -a` ; do rpm -V --nomd5 $foo ; done

    $ find / -type f \! -exec rpm --quiet -q -f {} \; -print

You'll need to modify them to --root and use the --redhatprovides to do the job. You'll probably want to remove the --nomd5 from the options also to be more secure.

You also need to replace the initrd images on /boot to be absolutely certain everything is clean. See man mkinitrd(8).

Packages installed since date

  • rpm -q -a --queryformat "%{INSTALLTIME:date} %{NAME}\n"

-- Frank Dean - 13 Dec 2004