Como lo instalamos en RHEL/CENTOS/FEDORA
1) Descargamos y descomprimimos el instalador:

# cd /opt/
# wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
# sudo tar -zxvf maldetect-current.tar.gz

2) Vamos al directorio que se creó e instalamos el script (el * es según la versión que hemos descomprimido)

# cd maldetect-*
# ./install.sh
Linux Malware Detect v1.5
(C) 2002-2015, R-fx Networks <proj@r-fx.org>
(C) 2015, Ryan MacDonald <ryan@r-fx.org>
This program may be freely redistributed under the terms of the GNU GPL

installation completed to /usr/local/maldetect
config file: /usr/local/maldetect/conf.maldet
exec file: /usr/local/maldetect/maldet
exec link: /usr/local/sbin/maldet
exec link: /usr/local/sbin/lmd
cron.daily: /etc/cron.daily/maldet
maldet(868951): {sigup} performing signature update check...
maldet(868951): {sigup} local signature set is version 20151014900
maldet(868951): {sigup} latest signature set already installed

3) Con esto tenemos instalado Linux Malware Detect (LMD), ahora vamos a configurarlo para que nos envíe una alerta:

# vi /usr/local/maldetect/conf.maldet
Para enviar un email de advertencia:
email_alert=1
Dirección de email que recibe las alertas
email_addr="you@domain.com"

4) Vamos a escanear un directorio:

# maldet --scan-all /home/soyadmin/public_html/old/
Linux Malware Detect v1.5
(C) 2002-2015, R-fx Networks <proj@rfxn.com>
(C) 2015, Ryan MacDonald <ryan@rfxn.com>
This program may be freely redistributed under the terms of the GNU GPL v2

maldet(54790): {scan} signatures loaded: 10822 (8908 MD5 / 1914 HEX / 0 USER)
maldet(54790): {scan} building file list for /home/soyadmin/public_html/old/, this might take awhile...
maldet(54790): {scan} setting nice scheduler priorities for all operations: cpunice 19 , ionice 6
maldet(54790): {scan} file list completed in 1s, found 8662 files...
maldet(54790): {scan} found clamav binary at /usr/local/cpanel/3rdparty/bin/clamdscan, using clamav scanner engine...
maldet(54790): {scan} scan of /home/soyadmin/public_html/old/ (8662 files) in progress...

maldet(54790): {scan} scan completed on /home/soyadmin/public_html/old/: files 8662, malware hits 0, cleaned hits 0, time 39s
maldet(54790): {scan} scan report saved, to view run: maldet --report 151109-1952.54790

5) Miramos el reporte:

# maldet --report 151109-1952.54790
HOST:       soyadmin.hostname
SCAN ID:   151109-1952.54790
STARTED:   Nov  9 2015 19:52:28 -0300
COMPLETED: Nov  9 2015 19:53:07 -0300
ELAPSED:   39s [find: 1s]

PATH:          /home/soyadmin/public_html/old/
TOTAL FILES:   8662
TOTAL HITS:    0
TOTAL CLEANED: 0

===============================================
Linux Malware Detect v1.5 < proj@rfxn.com >

6) Si deseamos podemos configurar un escaneo automatizado utilizando el cron diario:

# /etc/cron.daily/maldet

Espero les sirva, esta es para mi una herramienta muy necesaria.

La entrada ¿Como instalar Linux Malware Detect (LMD) en RHEL/CENTOS/FEDORA? se publicó primero en SoyAdmin.com.