Mastering Linux Security and Hardening

Configuring maldet

If you try to start the maldet service at this point, it will fail. To make it work, you need to configure the directories that you want it to automatically monitor and scan. To do this, you'll add the directories to the /usr/local/maldetect/monitor_paths file. For now, I just want to monitor the /home and /root directories, so my monitor_paths file looks like this:

/home/root

After you save the file, you'll be able to start the maldet daemon:

sudo systemctl start maldet

You can add more directories to the monitor_paths file at any time, but remember to restart the maldet daemon any time that you do, in order to read in the new additions.

The configuration file for LMD is /usr/local/maldetect/conf.maldet. It's very well-documented ...