#!/bin/bash
PATH=/usr/bin:/bin
TMPLOG=`mktemp`
# chkrootkit実行
chkrootkit > $TMPLOG

# ログ出力 cat $TMPLOG | logger -t chkrootkit

# SMTPSのbindshell誤検知対応
if [ ! -z "$(grep 465 $TMPLOG)" ] && [ -z $(/usr/sbin/lsof -i:465|grep bindshell) ]; then
      sed -i '/465/d' $TMPLOG
fi

# upstartパッケージ更新時のSuckit誤検知対応
if [ ! -z "$(grep Suckit $TMPLOG)" ] && [ -z $(rpm -V `rpm -qf /sbin/init`) ]; then
       sed -i '/Suckit/d' $TMPLOG
fi

# rootkit検知時のみroot宛メール送信
[ ! -z "$(grep INFECTED $TMPLOG)" ] && grep INFECTED $TMPLOG | mail -s "chkrootkit report in `hostname`" root

rm -f $TMPLOG