Linux Malware Detect, abbreviated as LMD or maldet, is a software package that looks for
malware on Linux systems and reports on it.
[Mastering Linux Security and Hardening by Donald A. Tevault Publisher: Packt Publishing Release Date: January 2018 ]
Details
To protect Linux systems against vulnerabilities, various software packages are available, such as rootkit detectors such as
Rootkit Hunter and
chkrootkit
chkrootkit (Check Rootkit) is a common Unix-based program intended to help system administrators check their system for known rootkits. It is a shell script using common UNIX/Linux tools like the strings and grep commands to search core syste ...
, and auditing systems like
lynis
Lynis is an extensible security audit tool for computer systems running Linux, FreeBSD, macOS, OpenBSD, Solaris, and other Unix derivatives. It assists system administrators and security professionals with scanning a system and its security defe ...
. Malware detection software such as LMD and
ClamAV
Clam AntiVirus (ClamAV) is a free software, cross-platform antimalware toolkit able to detect many types of malware, including viruses. It was developed for Unix and has third party versions available for AIX, BSD, HP-UX, Linux, macOS, OpenVMS, ...
improve the security of systems by scanning them based on the
signature
A signature (; from la, signare, "to sign") is a Handwriting, handwritten (and often Stylization, stylized) depiction of someone's name, nickname, or even a simple "X" or other mark that a person writes on documents as a proof of identity and ...
s of thousands of instances of known malware.
For malware signatures, LMD uses various sources such as the signatures database of ClamAV and the
Malware Hash Registry of
Team Cymru. Besides such third party signature databases, it also maintains its own database of signatures.
If a ClamAV scanner engine is already available on a system, LMD will use this for its scanner engine. This will normally give better performance than its built-in scanner engine.
LMD can quarantine malware, and it can clean software that contains malicious code.
The executable command of LMD is maldet. Typical
command invocations are ''maldet -d,'' to check for later versions; ''maldet -u,'' to check for malware signature updates; and ''maldet -a,'' to scan the file system of the server on which LMD resides. Checking for malware signature updates is typically done in an automated manner. Besides periodic scans, real-time monitoring is also supported with the ''--monitor'' command-line argument. LMD can monitor users, paths and files in such a way.
Linux Malware Detect is one of the objectives for the
LPI 303 certification.
References
{{Reflist
External links
R-fx Networks project page of LMD
Linux
Antivirus software for Linux
Free security software