Scanning for Rootkits with rkhunter

Continuing with the scanning for rootkits articles, we now concentrate on installing and configuring rkhunter.

Rkhunter works in the same manner as chkrootkit (see this article) but rkhunter also scans for other types of exploits.


Which one?

Neither rkhunter nor chkrootkit are necessarily better than the other and can easily be run at the same time, giving added defence measures and peace of mind.

As with chkrootkit, rkhunter is not an active defence method. It does not prevent exploits being placed on your Server but it will inform you if there is a suspected exploit. Again, as with chkrootkit, if you have been exploited then the only real option is to reinstall with a fresh image.


Log into your VPS and move to your sources directory:

cd ~/sources

Once there, download the latest version of rkhunter from the SourceForge download area:

This article was written using rkhunter 1.4.0 for all examples.


Being good sysadmins we want to check the md5sum of the downloaded file before extracting it and installing it.

To find the md5 signature of the downloaded package:

md5sum rkhunter-1.4.0.tar.gz

Compare this with the signature available on the Debian package list - ensure you look at the original download and not the diff patch that Debian applies.


After the archive is verified, extract the source code:

tar xvfz rkhunter-1.4.0.tar.gz

Then move into the newly created directory:

cd rkhunter-1.4.0/


To install the code, simply issue the following command:

sudo ./ --layout default --install


At the end of the install a message tells me:

Installation ready.
See /usr/local/rkhunter/lib/rkhunter/docs for more information.
Run 'rkhunter' (/usr/local/bin/rkhunter)

Have a read of the main docs:

sudo nano /usr/local/rkhunter/lib/rkhunter/docs/README

I won't go through what it says but do take some time to have a look and see what configurations are available.


First thing is to update the signatures and files rkhunter uses to detect anomalies:

sudo /usr/local/bin/rkhunter --update

Do that at least once or until you get an output like this:

Checking rkhunter data files...
    Checking file mirrors.dat                                  [ No update ]
    Checking file programs_bad.dat                             [ No update ]
    Checking file backdoorports.dat                            [ No update ]
    Checking file suspscan.dat                                 [ No update ]
    Checking file i18n/cn                                      [ No update ]
    Checking file i18n/de                                      [ No update ]
    Checking file i18n/en                                      [ No update ]
    Checking file i18n/zh                                      [ No update ]
    Checking file i18n/zh.utf8                                 [ No update ]


Let's run it:

sudo /usr/local/bin/rkhunter -c

This runs rkhunter in an interactive mode. In other words, when it gets to the end of a particular scan, you need to press 'enter' to continue.

My scan results were as follows:

---------------------------- Scan results ----------------------------
MD5 scan
Scanned files: 0
Incorrect MD5 checksums: 0
File scan
Scanned files: 342
Possible infected files: 0
Application scan
Vulnerable applications: 0
Scanning took 79 seconds

Which is nice.

If you want to skip the interactive mode, add the -sk option at the end:

sudo /usr/local/bin/rkhunter -c -sk

To see other options available for use:

sudo /usr/local/bin/rkhunter


You may have configured your Server in a way that triggers warnings from rkhunter.

Firstly, I would say listen to what it says and decide if you really need something that is a security risk and, secondly, if you do want the risk, there are ways of configuring rkhunter so it ignores certain things.

Here's an example. Let's say I ran rkhunter and got this message:

Checking for allowed root login... Watch out Root login possible. Possible risk!
    info: "PermitRootLogin yes" found in file /etc/ssh/sshd_config
    Hint: See logfile for more information about this issue

That's fairly straight forward: I left the "PermitRootLogin" set to "yes" in my sshd_config file.

Now we know that's a silly thing to do and it's a nice reminder to tighten up our SSH configuration.

But let's say we do want to enable root logins via SSH but don't want a warning every time we run rkhunter.

Enter /usr/local/etc/rkhunter.conf. Open it up:

sudo nano /usr/local/etc/rkhunter.conf

Scan down until you reach this line:


Uncomment the line and change the 0 to a 1


Now when we run rkhunter there are no highlighted warnings and this message:

Checking for allowed root login...  [ OK (Remote root login permitted by explicit option) ]

Now it's says root logins are OK, but specifies why it's OK: You explicitly allowed it.

However, please don't allow root logins. Thanks.


Lastly, we know that automation and email notification make an administrator's life a lot easier, so now we can add rkhunter to a cronjob.

This is straight from the rkhunter website: You need to create a short shell script as follows:

( /usr/local/bin/rkhunter --versioncheck
/usr/local/bin/rkhunter --update
/usr/local/bin/rkhunter --cronjob --report-warnings-only
) | /usr/bin/mail -s "rkhunter output"

Save the file and call it something like 'rkhunterscript'. Make the file executable and set its owner to root.

chmod 700 rkhunterscript
sudo chown root rkhunterscript

Place in your local bin folder or in root's home directory.

sudo mv rkhunterscript /usr/local/bin

Now set a root cronjob to run the script periodically:

sudo crontab -e

My cronjob looks like this:

10 3 * * * /usr/local/bin/rkhunterscript -c --cronjob

This will run the script at 3.10am each day. Why 3.10am? Well, I have chkrootkit running at 3.00am, I'd like that to finish before starting this one.

© 2015 Rackspace US, Inc.

Except where otherwise noted, content on this site is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License

See license specifics and DISCLAIMER