How to Integrate rkhunter with yum

One of the features of `rkhunter` in CentOS that I miss is the ability to update `rkhunter`’s property database automatically after `yum` is run. In Debian, it is possible to instruct `dpkg` to run `rkhunter –propupd` after each install/upgrade/removal operation automatically so that the user does not have to type `rkhunter –propupd` manually.

It should be noted that this feature comes with two warnings:

When using automatic database update after each package install/upgrade, an attacker could replace a file after it is installed, and before `–propupd` is run. On a highly protected machine, it is recommended to disable the automatic database update.

It is the users’ responsibility to ensure that the files on the system are genuine and from a reliable source. `rkhunter` can only report if a file has changed, but not on what has caused the change. Hence, if a file has changed, and the `–propupd` command option is used, then `rkhunter` will assume that the file is genuine.

When I manage a server for a client, for me this is an acceptable risk: I always have other means of intrusion detection, including integrity checks of critical files and directories, and I usually do not want a non-tech savvy client to be upset if they see a warning that a system file has changed.

Luckily, this is doable with the help of plugins (much like the way I have implemented this for `monit`).

import re
import os
import os.path
import yum
from yum.plugins import TYPE_CORE

requires_api_version = '2.1'
plugin_type = (TYPE_CORE,)

active = False

def init_hook(conduit):
    global active
    active = False
    try:
        content = open('/etc/rkhunter.conf').read()
        if not re.match('^DISABLE_TESTS=.*(hashes.*attributes|attributes.*hashes|properties)', content) or re.match('^ENABLE_TESTS=.*(hashes|attributes|properties)', content):
            active = True
    except:
        pass

def posttrans_hook(conduit):
    global active
    exe = '/usr/bin/rkhunter'
    if active and os.path.isfile(exe):
        conduit.info(2, 'Updating rkhunter property database')
        command = '%s --propupd --pkgmgr RPM --nolog' % exe
        os.system(command)

[main]
enabled=1

The plugin mimics Debian’s rkhunter behavior: if `hashes` and `attributes` tests are disabled, property database is not updated automatically (this check is performed in `init_hook`: if the database is to be updated, `active` is set to `True`). `posttrans_hook` checks the `active` flag and whether `rkhunter` binary exists. If both conditions are true, it runs `rkhunter –propupd –pkgmgr RPM –nolog` (unlike Debian, the package manager is specified explicitly).

The full source code is available on GitHub.