Mastering Linux Security and Hardening - Second Edition

Hands-on lab – configuring maldet

In previous versions, maldet was configured by default to automatically monitor and scan users' home directories. In its current version, the default is for it to only monitor the /dev/shm, /var/tmp, and /tmp directories. We're going to reconfigure it so that we can add some directories. Let's get started:

1. Open the /usr/local/maldetect/conf.maldet file for editing. Find these two lines:

default_monitor_mode="users"# default_monitor_mode="/usr/local/maldetect/monitor_paths"

Change them to the following:

# default_monitor_mode="users"default_monitor_mode="/usr/local/maldetect/monitor_paths"

2. At the top of the file, enable email alerts and set your username as the email address. The two lines should now look ...