Overview
Linux Pods can be infected by malware, rootkits and crypto-mining scripts, usually after a weak password or an outdated application is exploited. This article covers practical tools and habits to detect and prevent infections.
Before you begin
- Root or sudo access.
- Enough free disk space for virus signature databases (ClamAV needs a few hundred MB).
Steps
- Do not let it get in. Apply updates, harden SSH, run a firewall, and use Fail2ban. See the related articles below.
- Reduce what runs as root. Serve websites as an unprivileged user and follow the principle of least privilege.
- Scan for rootkits with
chkrootkitorrkhunter:
bash
sudo apt install rkhunter
sudo rkhunter --update
sudo rkhunter --check
- Install ClamAV to scan for malware and malicious uploads:
bash
sudo apt install clamav clamav-daemon
sudo systemctl stop clamav-freshclam
sudo freshclam
sudo systemctl start clamav-freshclam
sudo clamscan -r --bell -i /home /var/www
Look for the usual warning signs:
- Unexplained CPU usage or a Pod that is always busy.
- Unexpected outbound connections (
ss -tp,lsof -i). - New cron jobs, SSH keys or user accounts you did not create.
- Modified system binaries.
Check for unauthorised persistence:
bash
sudo crontab -l
ls -la /etc/cron.*
sudo ls -la /root/.ssh
- Automate scans with a weekly cron job, and install a file integrity monitor such as AIDE to detect changes to system files.
Troubleshooting
- Problem:
freshclamfails to update signatures. Solution: Stop the daemon first (as shown above) so the database files are not locked, then retry. - Problem: ClamAV scanning is very slow. Solution: Limit the scan to web roots and user directories rather than the whole filesystem.
Related articles
- [Incident response: what to do if you are compromised]
- [Keeping your server patched]
- [Security best practices for your Pod]
