Thread: Linux Run Rkhunter And Send Reports Via Email ( Cronjob )

Thanks

Display this message and nothing happens

root@server [/etc/cron.daily]# bash rkhunter.sh
You must specify direct recipients with -s, -c, or -b.

OK,
I have installed this on rhel4 and it is working. Call this script exactly from cron.

Code:

[root@qatestapp ~]# cat rkhunter.sh 
#!/bin/sh

( /usr/local/bin/rkhunter --versioncheck
/usr/local/bin/rkhunter --update
/usr/local/bin/rkhunter --cronjob --report-warnings-only
) | mail -s "rkhunter output" jralph@domain.com

This script I found from this site, the only change that I made was the path to the mail executable. I removed it cause it failed.

http://articles.slicehost.com/2010/3...hunter-updated
jaysunn

Jaysunn is right,

Code:

#!/bin/bash
/usr/local/bin/rkhunter --cronjob 2>&1 > /tmp/RKhunter_Scan_Details && mail -s 'Output' my_email < /tmp/RKhunter_Scan_Details

Hello all thank you very much and worked

Originally Posted by jaysunn

OK,
I have installed this on rhel4 and it is working. Call this script exactly from cron.

Code:

[root@qatestapp ~]# cat rkhunter.sh 
#!/bin/sh

( /usr/local/bin/rkhunter --versioncheck
/usr/local/bin/rkhunter --update
/usr/local/bin/rkhunter --cronjob --report-warnings-only
) | mail -s "rkhunter output" jralph@domain.com

This script I found from this site, the only change that I made was the path to the mail executable. I removed it cause it failed.

Slicehost Articles: Scanning for rootkits with rkhunter
jaysunn

Good script and there is small problem (including my version), if rkhunter failed to produce output file, than mail command will send an email with empty body message. The workaround is to add additional if command and check wheter file is empty or not and send message according to that.. may be something like

Code:

rkhunter options > /tmp/output
if [ /tmp/output file is not empty ] 
  email it using mail options
else
  email warning message stating rkhunter failed to scan
fi

/Solved

Originally Posted by nixcraft

Code:

rkhunter options > /tmp/output
if [ /tmp/output file is not empty ] 
  email it using mail options
else
  email warning message stating rkhunter failed to scan
fi

I dont think so it will run either

this is indeed a great little script, but since I get messages sent to my droid each morning about the status of numerous servers I just use:

rkhunter --cronjob --nomow --summary

and then if need be I can do more research by looking in the log files

thanks!