What is a Rootkit?
A rootkit is a type of malicious software designed to give an attacker persistent, privileged (root) access to a system while hiding its presence from administrators and standard monitoring tools. Rootkits often achieve this by modifying core system binaries (like ls, ps, or netstat) so they intentionally hide malicious processes and files. Rootkit Hunter (rkhunter) is a widely used security auditing tool that scans Linux systems for known rootkits, backdoors, and local exploits by comparing file hashes and searching for suspicious strings in system binaries.
Step 1: Install rkhunter
Rootkit Hunter is available in the default repositories of almost all major Linux distributions.
On Debian/Ubuntu servers:
sudo apt update && sudo apt install rkhunter -y
On RHEL/CentOS systems (requires EPEL):
sudo yum install epel-release -y
sudo yum install rkhunter -y
During installation on Debian-based systems, you may be prompted to configure mail settings. You can select “Local only” if you do not have a mail server configured.
Step 2: Update the rkhunter Database
Before running a scan, you must update the tool’s signature database to ensure it can detect the latest known threats. Run the following command:
sudo rkhunter --update
Step 3: Establish Baseline File Properties
Because rkhunter works by verifying the integrity of core system binaries, it needs to establish a “known good” baseline. You should run the propupd command to populate the local properties database. (Note: Only do this if you are confident the system is currently clean, such as immediately after a fresh OS installation).
sudo rkhunter --propupd
Step 4: Execute a Full System Scan
To initiate a comprehensive scan of your server, use the --check or -c flag. By default, rkhunter requires you to press ‘Enter’ after each phase of the scan. To run it non-interactively (ideal for scripts), use the --sk (skip keypress) flag:
sudo rkhunter -c --sk
The tool will check for rootkits, verify system commands, check for hidden directories, and evaluate network ports.
Step 5: Review the Scan Logs
Once the scan completes, a summary will be displayed on the screen. If you see any “Warnings” highlighted in red, you must investigate them. Some warnings may be false positives (such as legitimate administrative scripts changing system settings).
To view the detailed log of the scan, including the exact files that triggered the warnings, open the log file:
sudo cat /var/log/rkhunter.log | grep Warning
It is recommended to schedule rkhunter to run daily via a cron job, emailing the results to the administrator to maintain proactive security monitoring.