How to Run a Linux Server Security Audit on Webmin Using rkhunter, Lynis, and ClamAV

# On RHEL/CentOS/AlmaLinux:
yum install rkhunter -y

# On Debian/Ubuntu:
apt-get install rkhunter -y

# Verify installation:
rkhunter --version

rkhunter --update
rkhunter --propupd

The --propupd flag creates a baseline of your current system file properties (MD5 hashes, permissions, owners). Run this immediately after a clean install so rkhunter has a known-good reference to compare against.

rkhunter --check --sk --rwo 2>&1 | tee /var/log/rkhunter_$(date +%Y%m%d).log

• --sk skips the keypress prompts (for scripted runs)
• --rwo prints only warnings and errors, not the full scan output

Review warnings carefully. Common false positives include cPanel or Plesk tools that modify system binaries — these should be whitelisted in /etc/rkhunter.conf rather than ignored. Genuine red flags are warnings about hidden processes, strings in kernel memory, or mismatched hashes on system commands like /bin/ps, /bin/netstat, or /usr/sbin/sshd.

Edit /etc/rkhunter.conf and add:

# Whitelist custom scripts or paths that trigger false positives:
SCRIPTWHITELIST=/usr/sbin/adduser
ALLOWHIDDENDIR=/dev/.udev
ALLOWHIDDENFILE=/dev/.blkid.tab

# On RHEL/CentOS/AlmaLinux:
yum install lynis -y

# On Debian/Ubuntu:
apt-get install lynis -y

# Alternatively, install the latest version from the Lynis project:
cd /opt && git clone https://github.com/CISOfy/lynis && cd lynis

lynis audit system 2>&1 | tee /var/log/lynis_$(date +%Y%m%d).log

The audit takes 2-5 minutes and covers over 300 security checks. Pay attention to the Hardening index score at the end — a score below 65 out of 100 means your server has significant security weaknesses.

Lynis outputs suggestions in three categories:

• WARNING — active security risk, fix immediately
• SUGGESTION — hardening improvement, fix when possible
• INFO — informational, no immediate action needed

The most impactful fixes are usually:

# SSH hardening (from Lynis suggestion SSH-7408):
# Edit /etc/ssh/sshd_config and set:
Protocol 2
PermitRootLogin no
MaxAuthTries 3
PasswordAuthentication no  # (only after setting up SSH keys)
AllowUsers your_admin_user

# Kernel hardening (from Lynis suggestion KRNL-6000):
# Edit /etc/sysctl.conf and add:
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.log_martians = 1
kernel.randomize_va_space = 2

# Apply kernel settings immediately:
sysctl -p

# AUTH-9286: Check for empty password fields in /etc/shadow
awk -F: '($2 == "" ) { print $1 " has no password" }' /etc/shadow

# FILE-7524: World-writable files (common in web directories)
find /home /var/www -perm -o+w -type f 2>/dev/null | head -20

# FIRE-4508: Check that a firewall is active
systemctl status firewalld || iptables -L -n | head -5

# On RHEL/CentOS/AlmaLinux:
yum install clamav clamd clamav-update -y

# On Debian/Ubuntu:
apt-get install clamav clamav-daemon -y

# Update virus definitions immediately:
freshclam

# Scan all web roots — adjust path for your setup:
clamscan -r --infected --remove=no --log=/var/log/clamav_$(date +%Y%m%d).log   /home /var/www /usr/share/webapps 2>/dev/null

# For a faster scan of only PHP files (where web shells hide):
find /home /var/www -name "*.php" |   clamscan --infected --log=/var/log/clamav_php_$(date +%Y%m%d).log -f -

Use --remove=no on the first run to review infected files before deletion. Never auto-delete without reviewing — false positives can remove legitimate plugin files.

# View scan results:
grep "FOUND" /var/log/clamav_$(date +%Y%m%d).log

# Move infected files to quarantine (don't delete yet):
mkdir -p /root/quarantine/$(date +%Y%m%d)
grep "FOUND" /var/log/clamav_$(date +%Y%m%d).log |   awk '{print $1}' | sed 's/://' |   xargs -I{} mv {} /root/quarantine/$(date +%Y%m%d)/

Webmin → System → Scheduled Commands → Add Scheduled Command:

• Command: rkhunter --update && rkhunter --check --sk --rwo --logfile /var/log/rkhunter_weekly.log
• Run as: root
• Schedule: Weekly (Sunday at 3:00 AM)

• Command: lynis audit system --quiet --logfile /var/log/lynis_weekly.log
• Schedule: Weekly (Sunday at 3:30 AM)

• Command: freshclam && clamscan -r --infected --log=/var/log/clamav_weekly.log /home /var/www
• Schedule: Weekly (Sunday at 4:00 AM)

Webmin → System → System Logs → add the log file paths (/var/log/rkhunter_weekly.log, /var/log/lynis_weekly.log, /var/log/clamav_weekly.log) as watched log files for easy review from the panel.