Malware Detect (Maldet) Scanner for cPanel
Introduction
Linux Malware Detect (Maldet or LMD) is an open-source malware scanner designed for Linux servers, especially web hosting environments such as cPanel/WHM. It helps administrators detect malicious files, web shells, backdoors, and other malware that may exist in users’ websites.
Maldet can scan specific directories, identify infected files, quarantine malicious content, and attempt to clean supported malware automatically. It also integrates well with cPanel environments and can send email notifications after scans.
Prerequisites
Before installing Maldet, ensure that:
- You have root or sudo access to the server.
- The server is running a Linux distribution supported by cPanel.
- Internet connectivity is available to download the installation package.
- cPanel/WHM is installed (recommended for full integration).
Installation Steps
Step 1: Download the latest Maldet package
wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
Step 2: Extract the downloaded archive
tar -xzvf maldetect-current.tar.gz
Step 3: Navigate to the extracted directory
cd maldetect-*
Step 4: Run the installation script
sh install.sh
After a successful installation, Maldet installs the following important files:
| File | Description |
|---|---|
/usr/local/maldetect/conf.maldet | Main configuration file |
/usr/local/maldetect/maldet | Maldet executable |
/usr/local/sbin/maldet | Command-line shortcut |
/usr/local/sbin/lmd | Alternative command |
/etc/cron.daily/maldet | Daily scheduled scan script |
Important Configuration Options
The primary configuration file is located at:
/usr/local/maldetect/conf.maldet
Some commonly used configuration options include:
email_alert
Enables or disables email notifications after scans.
email_addr
Specifies one or more email addresses that receive scan reports.
quar_hits
Moves detected malware into quarantine and removes its permissions.
quar_clean
Attempts to automatically clean supported malware signatures before restoring the files.
quar_susp
Suspends the cPanel account if malware is detected under that user account.
quar_susp_minuid
Defines the minimum user ID that is eligible for automatic suspension.
Manual Scan Examples
Scan all cPanel public_html directories
maldet --scan-all /home?/?/public_html
Scan files modified within the last 5 days
maldet --scan-recent /home?/?/public_html 5
Quarantine malware from a previous scan
maldet --quarantine SCANID
Replace SCANID with the scan ID generated after the malware scan.
Clean malware from a previous scan
maldet --clean SCANID
Replace SCANID with the appropriate scan ID.
Conclusion
Linux Malware Detect (Maldet) is a simple and effective malware scanning solution for cPanel servers. It provides malware detection, quarantine, and cleaning capabilities while integrating seamlessly with cPanel user accounts. By configuring email alerts and running regular scans, administrators can proactively identify and mitigate malware infections, helping maintain the security and integrity of hosted websites.
