Just another WebvIsion weblog

Server administration

install linux malware detect lmd On Centos-and-fedora

LMD is not available from online repositories, but is distributed as a tarball from the project’s web site. The tarball containing the source code of the latest version is always available at the following link, where it can be downloaded with:

# wget http://www.rfxn.com/downloads/maldetect-current.tar.gz

Then we need to unpack the tarball and enter the directory where its contents were extracted. Since current version is 1.4.2, the directory is maldetect-1.4.2. There we will find the installation script, install.sh.

# tar -xvf maldetect-current.tar.gz
# ls -l | grep maldetect

Download Linux Malware Detect

Download Linux Malware Detect

If we inspect the installation script, which is only 75 lines long (including comments), we will see that it not only installs the tool, but also performs a pre-check to see if the default installation directory (/usr/local/maldetect) exists. If not, the script creates the installation directory before proceeding.

Finally, after the installation is completed, a daily execution via cron is scheduled by placing the cron.daily script (refer to the image above) in /etc/cron.daily. This helper script will, among other things, clear old temporary data, check for new LMD releases, and scan the default Apache and web control panels (i.e., CPanel, DirectAdmin, to name a few) default data directories.

That being said, run the installation script as usual:

# ./install.sh

Install Linux Malware Detect in Linux

Install Linux Malware Detect in Linux

Configuring Linux Malware Detect

The configuration of LMD is handled through /usr/local/maldetect/conf.maldet and all options are well commented to make configuration a rather easy task. In case you get stuck, you can also refer to/usr/local/src/maldetect-1.4.2/README for further instructions.

In the configuration file you will find the following sections, enclosed inside square brackets:


Each of these sections contains several variables that indicate how LMD will behave and what features are available.

  1. Set email_alert=1 if you want to receive email notifications of malware inspection results. For the sake of brevity, we will only relay mail to local system users, but you can explore other options such as sending mail alerts to the outside as well.
  2. Set email_subj=”Your subject here” and email_addr=username@localhost if you have previously set email_alert=1.
  3. With quar_hits, the default quarantine action for malware hits (0 = alert only, 1 = move to quarantine & alert) you will tell LMD what to do when malware is detected.
  4. quar_clean will let you decide whether you want to clean string-based malware injections. Keep in mind that a string signature is, by definition, “a contiguous byte sequence that potentially can match many variants of a malware family”.
  5. quar_susp, the default suspend action for users with hits, will allow you to disable an account whose owned files have been identified as hits.
  6. clamav_scan=1 will tell LMD to attempt to detect the presence of ClamAV binary and use as default scanner engine. This yields an up to four times faster scan performance and superior hex analysis. This option only uses ClamAV as the scanner engine, and LMD signatures are still the basis for detecting threats.

Important: Please note that quar_clean and quar_susp require that quar_hits be enabled (=1).

Summing up, the lines with these variables should look as follows in /usr/local/maldetect/conf.maldet:

email_subj="Malware alerts for $HOSTNAME - $(date +%Y-%m-%d)"

Other Short Options

1 – Install maldet

cd /usr/local/src/ && wget http://www.rfxn.com/downloads/maldetect-current.tar.gz && tar -xzvf maldetect-current.tar.gz && cd maldetect-* && sh install.sh

This will automatically install a cronjob inside /etc/cron.daily/maldet so a daily scan will be run for local cPanel or Plesk accounts.
2 – Make sure to update to the latest version and virus signatures:

maldet -d && maldet -u

3 – Run the first scan manually

To scan a specific user’s home directory, run the following command:

maldet -a /home/user

To launch a background scan for all user’s public_html and public_ftp in all home directories, run the following command:

maldet -b –scan-all /home?/?/public_?

(We also recommend you to scan /tmp and /dev/shm/)

4 – Verify the scan report

We recommend you to always read the scan reports before doing a quarantine. You will also be able to identify infected websites for further actions.

List all scan reports time and SCANID:

maldet –report list

Show a specific report details :

maldet –report SCANID


Show all scan details from log file:

grep “{scan}” /usr/local/maldetect/event_log


5 – Clean the malicious files

By default the quarantine is disabled. You will have to launch it manually.

maldet -q SCANID

clamav – How To

  • Install 
    sudo apt-get install clamav
  • Terminal

    At first you have to update the virus definitions with:

    sudo freshclam

    Then you can scan for viruses.

    clamscan OPTIONS File/Folder 

    If necessary start with root permissions: sudo clamscan.


    • To check all files on the computer, displaying the name of each file:
      clamscan -r /
    • To check all files on the computer, but only display infected files and ring a bell when found:
      clamscan -r --bell -i /
    • To scan all files on the computer but only display infected files when found and have this run in the background:
      clamscan -r -i / &

      Note – Display background process’s status by running the jobs command.

    • To check files in the all users home directories:
      clamscan -r /home
    • To check files in the USER home directory and move infected files to another folder:
      clamscan -r --move=/home/USER/VIRUS /home/USER
    • To check files in the USER home directory and remove infected files (WARNING: Files are gone.):
      clamscan -r --remove /home/USER
    • To see more options:
      clamscan --help

How to Sort Folders by Size With One Command Line in Linux

I often need to find out what are the biggest folders from the space point of view. Take for example, I need to get the users that are using the most space on the system that gets close to filling up the hard drive. If we consider that the entire user’s data is under /home, I need to have a list of all the subfolders sorted by the size of the subfolders.

This can be achieved in many was on Linux, and for example if you have quota enabled it can be as easy as checking the quota list. But if quota is not enabled on the partition, I am using the following simple command to get the list of subfolders sorted by their size:

du --max-depth=1 /home/ | sort -n -r

If this is really big, as it often is, you might want to direct the output of the command to a file, and check back later in a few minutes when it is finished. 🙂 The result of this will include also the top level folder, and will look like this:

238208  /home/
164340  /home/marius
9324    /home/users
3660    /home/shared
32      /home/admin

Other ways I use du:

du -H --max-depth=1 /home/user

where I included “-H” to produce human readable format sizes (like: 1K 101M 2G)

du –block-size=MiB –max-depth=1 | sort -n -r



based on


ISPConfig – Hosting Control Panel Software (Open Source)

ISPConfig – Hosting Control Panel Software (Open Source)

ISPConfig 3

  • Manage multiple servers from one control panel
  • Web server management (Apache2 and nginx)
  • Mail server management (with virtual mail users)
  • DNS server management (BIND and MyDNS)
  • Virtualization (OpenVZ)
  • Administrator, reseller and client login
  • Configuration mirroring and clusters
  • Open Source software (BSD license)

ISPConfig 3.0.4. released

ISPConfig 3.0.4 is available for download. This release is a major update and introduces new functions like:

  • Virtual server management module
  • Full support for Nginx webserver
  • Mailman mailinglist management
  • IPv6 support
  • FAQ section in Help module
  • Website folder protection
  • Assign IP addresses to clients
  • SNI support for Apache/nginx SSL certificate
  • New remote-API documentation and example scripts for all functions
  • Added support for key based SSH logins

Read full announcement…


System Requirements

ISPConfig 3

Debian 5 & 6, Ubuntu 8.10 – 12.10, CentOS 5.2 – 6.3, Fedora 10 and 12-15, OpenSuSE 11.1 – 12.2. More …


If the system meets all the requirements listed above, then you can run our software on almost any web host.