How to Install and Use Maldet

Linux Malware Detect (maldet for short) is a free scanner that finds malware on Linux servers. It is mainly used to find backdoors and malicious scripts uploaded to websites. It runs on AlmaLinux / Rocky Linux 8, 9, 10, Debian and Ubuntu, and recognises control panels such as cPanel, Plesk and DirectAdmin.

Installation

cd /usr/local/src
wget https://www.rfxn.com/downloads/maldetect-current.tar.gz
tar zxvf maldetect-current.tar.gz
cd maldetect-*/
./install.sh

The installer does the following:

• Installs the program to /usr/local/maldetect and adds the maldet command,
• Adds a daily job (/etc/cron.daily/maldet) that updates signatures and scans website files changed in the last day,
• If ClamAV is installed, makes the maldet signatures available to ClamAV as well.

An existing installation is backed up; you can update with the same commands.

Scanning

To scan a whole directory (in the example, the files of all websites on cPanel; ? matches every user):

maldet -a /home/?/public_html

On a Plesk server, websites are under /var/www/vhosts/:

maldet -a /var/www/vhosts/?/

Scanning only recently changed files is faster. For files changed in the last 2 days:

maldet -r /home/?/public_html 2

When the scan finishes, the screen shows a scan ID (SCANID) and how many malicious files were found.

Results and quarantine

maldet --report SCANID

The report shows the files found and which signature they matched. To quarantine the files found (make them unusable and move them aside):

maldet -q SCANID

To restore a file quarantined by mistake, use maldet -s SCANID. Review the report before deleting the files found; sometimes a legitimate plugin file can match too.

Settings

The configuration file is /usr/local/maldetect/conf.maldet; every option is described inside the file. Common ones:

• quarantine_hits=1: files found are quarantined automatically during scans (default 0, report only).
• email_alert=1 and email_addr: scan results are sent by email.

You can also pass an option for a single scan without changing the file:

maldet -co quarantine_hits=1 -a /home/?/public_html

Updates

maldet -u
maldet -d

-u updates the malware signatures, -d updates the program itself. The daily job already does both.

Server load

Scanning uses the disk heavily. maldet therefore runs scans with low disk and CPU priority by default; still, on servers with many files we recommend running large scans during off-peak hours.

The information in this guide is taken from official documentation: Linux Malware Detect (GitHub), R-fx Networks.