rkdet rootkit detector

Andrew Daviel <andrew@vancouver-webpages.com>
February 2000

Installation:
The file list "xfiles.txt" should be customised for the target system; this
is the list of files which are verified.
The string list "xstrings.txt" may require customising for the target system to
set the location of some system commands. md5sum, for instance, is used
to compute checksums. If desired, it may be installed under an 
alternate name to frustrate attempts to disable it.

First, customise the scripts and files in xfiles.txt, xstrings.txt.
To verify correct unmangling of the file list, commands and messages,
type "make check".
To build the program, type "make".
To install, type "make install".
To clean up, type "make clean".

There are some defines in rkdet.c which may need changing
#define MAXF 20       /* maximum number of files to check */
#define SIZES 3000    /* space to allocate to checksums */
#define SIZEF 2000    /* space to allocate to filenames */
The configure script should probably rewrite these, but it doesn't


If paranoid, replace RM in the makefile with your favourite disk
wiping program (rm merely removes directory entries, so that deleted
files can be seen on the disk. If truly paranoid, build this on
removable media in an RF-shielded room. First disable swapfiles, 
afterwards power off the system (to wipe RAM) and shred the media...

The build process uses a pair of Perl scripts to mangle the file list etc. and
create corresponding include files for the main C program.


An RPM specification is included, so that RPM commands such as
 rpm -ba rkdet-0.51.spec
 rpm -hi rkdet-0.51.rpm
should work.

After installation, the source files should be removed from the system.
The README (under /usr/doc) and init.rc/rkdet may be customised for your 
site, so that curious authorized users have some way to discover what
this program is for, or at least that they should not mess with it.

