Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

4
  • rpm -pV can verify an individual package on rpm based systems. So a loop over installed packages can tell you if any file installed is incorrect. Will not catch extra files. Commented Mar 22, 2021 at 22:31
  • 1
    Thanks for the tip. As a slight addendum, rpm has also -a option to select all installed packages, so one can run rpm -Va to verify all installed packages in one go. Commented Mar 23, 2021 at 0:05
  • rkhunter checks for some IoCs, but its main feature (checksumming your binaries) will not help you at this point Commented Mar 23, 2021 at 11:27
  • @Panki Thx for the tip. I had kind of always assumed that using both ClamAV and rkhunter is redundant. But I've been reading up about rkhunter for last two days and it seems that I was wrong and rkhunter indeed has a few tricks of its own. Though you're right in that checksumming binaries is not relevant in my use case. The only way to make it work without prior property database creation is to instruct rkhunter to use package manager file property verification via --pkgmgr option. But this is redundant to aforementioned rpm -Va command. Commented Mar 24, 2021 at 20:06