How to locally checks for signs of a rootkit
One tool that important for linux server to locally checks for signs of a rootkit is CHKROOTKIT. It contains chkrootkit: a shell script that checks system binaries for rootkit modification; ifpromisc.c: checks if the network interface is in promiscuous mode; chklastlog.c: checks for lastlog deletions; chkwtmp.c: checks for wtmp deletions; check_wtmpx.c: checks for wtmpx deletions [...]



