If you try to start the maldet service at this point, it will fail. To make it work, you need to configure the directories that you want it to automatically monitor and scan. To do this, you'll add the directories to the /usr/local/maldetect/monitor_paths file. For now, I just want to monitor the /home and /root directories, so my monitor_paths file looks like this:
/home
/root
After you save the file, you'll be able to start the maldet daemon:
sudo systemctl start maldet
You can add more directories to the monitor_paths file at any time, but remember to restart the maldet daemon any time that you do, in order to read in the new additions.
The configuration file for LMD is /usr/local/maldetect/conf.maldet. It's very well-documented with well-written comments for every configuration item, so you shouldn't have any trouble figuring it out. For now, we're only going to make a few configuration changes.
At the top of the file, enable email alerts and set your username as the email address. The two lines should now look something like this:
email_alert="1"
email_addr="donnie"
LMD isn't already configured to move suspicious files to the quarantine folder, and we want to make it do that. Open the conf.maldet file in your text editor and look for the line that says:
quarantine_hits="0"
Change the previous line to the following line:
quarantine_hits="1"
You'll see a few other quarantine actions that you can configure, but for now, this is all we need. After you save the file, restart maldet:
sudo systemctl restart maldet
The new changes will now be in effect.