Maldet is a Linux Malware Detect (LMD) is a malware scanner for Linux servers. The signatures that LMD uses are MD5 file hashes and HEX pattern matches, they are also easily exported to any number of detection tools such as ClamAV.

Following are the steps to install and configure maldet:

[1] Download maldet from rfxn.com using the following command:

root@server[~]# wget http://www.rfxn.com/downloads/maldetect-current.tar.gz

[2] Extract the package and run install.sh using the following commands:

root@server [~]# tar xfz maldetect-current.tar.gz
root@server [~]# cd maldetect-*
root@server [~/maldetect-1.4.2]# ./install.sh
Linux Malware Detect v1.4.2
(C) 2002-2013, R-fx Networks <[email protected]>
(C) 2013, Ryan MacDonald <[email protected]>
inotifywait (C) 2007, Rohan McGovern <[email protected]>
This program may be freely redistributed under the terms of the GNU GPL

installation completed to /usr/local/maldetect
config file: /usr/local/maldetect/conf.maldet
exec file: /usr/local/maldetect/maldet
exec link: /usr/local/sbin/maldet
exec link: /usr/local/sbin/lmd
cron.daily: /etc/cron.daily/maldet

maldet(13081): {sigup} performing signature update check…
maldet(13081): {sigup} local signature set is version 201205035915
maldet(13081): {sigup} new signature set (2014122716540) available
maldet(13081): {sigup} downloaded http://cdn.rfxn.com/downloads/md5.dat
maldet(13081): {sigup} downloaded http://cdn.rfxn.com/downloads/hex.dat
maldet(13081): {sigup} downloaded http://cdn.rfxn.com/downloads/rfxn.ndb
maldet(13081): {sigup} downloaded http://cdn.rfxn.com/downloads/rfxn.hdb
maldet(13081): {sigup} downloaded http://cdn.rfxn.com/downloads/maldet-clean.tgz
maldet(13081): {sigup} signature set update completed
maldet(13081): {sigup} 11866 signatures (9965 MD5 / 1901 HEX)

Now maldet is installed successfully. You can now open maldet configuration file /usr/local/maldetect/conf.maldet using any editor. Following are few commonly used options in maldet configurations:

[1] email_alert

If you wish to receive email alert for daily scan, you need to enable this option.

[2] email_addr

When you enable email_alert option, you will have to set email address where you would like to receive alert.

There are other options related to quarantine, auto suspend etc. You can adjust other options as per your need.