A rootkit hides an attacker’s presence on a compromised system. It replaces system tools, hides processes and files, and keeps a backdoor open. rkhunter (Rootkit Hunter) and chkrootkit look for known rootkits, suspicious file changes and typical signs of compromise. Neither is perfect, but both are free, lightweight checks worth running on internet-facing servers.

Install

sudo apt install rkhunter chkrootkit          # Debian/Ubuntu
sudo dnf install rkhunter chkrootkit          # RHEL family (EPEL)

rkhunter

Initial setup

rkhunter compares system binaries against a baseline of known-good file properties (hashes, permissions). Create the baseline on a system you trust, ideally right after installation:

sudo rkhunter --update          # update data files
sudo rkhunter --propupd         # record current file properties as the baseline

On Debian/Ubuntu, fix the default config so updates work. In /etc/rkhunter.conf:

UPDATE_MIRRORS=1
MIRRORS_MODE=0
WEB_CMD=""

and in /etc/default/rkhunter:

CRON_DAILY_RUN="true"
CRON_DB_UPDATE="true"
APT_AUTOGEN="true"

APT_AUTOGEN refreshes the baseline automatically after apt upgrades, which avoids a flood of false “file changed” warnings.

Run a check

sudo rkhunter --check --sk           # --sk = skip "press Enter" prompts
sudo rkhunter --check --rwo          # report warnings only

Results are logged to /var/log/rkhunter.log. Look at the summary at the end and at any Warning: lines.

Common false positives

Warning Usually means Fix
“The file properties have changed” for /usr/bin/* A package update changed binaries Verify with dpkg -V or rpm -Va, then rkhunter --propupd
“Hidden file found: /etc/.updated, /dev/.udev” Normal system files Whitelist with ALLOWHIDDENFILE=
“SSH root access is allowed” Your sshd config Fix the config or set ALLOW_SSH_ROOT_USER
“/usr/bin/lwp-request is a script” Normal Perl script SCRIPTWHITELIST=/usr/bin/lwp-request

Always verify before whitelisting. Confirm the file belongs to a package and is unmodified:

dpkg -S /usr/bin/ss && dpkg -V iproute2       # Debian/Ubuntu: no output from -V = unchanged
rpm -qf /usr/bin/ss && rpm -V iproute         # RHEL family

chkrootkit

sudo chkrootkit
sudo chkrootkit -q          # quiet: only show possible problems

Typical false positives: “INFECTED (PORTS: 465)” when you run a mail server, or packet sniffer warnings for DHCP clients and tcpdump processes. Check whether the flagged port or process is something you run on purpose.

Debian’s daily cron for chkrootkit is configured in /etc/chkrootkit/chkrootkit.conf (RUN_DAILY="true").

Schedule scans and get reports

The packages install daily cron jobs (when enabled) that mail output to root. Make sure root’s mail reaches you. Set an alias in /etc/aliases (root: [email protected], then newaliases), with a working MTA. Or wrap the scan yourself:

sudo rkhunter --cronjob --report-warnings-only --appendlog

If a scan finds something real

A genuine rootkit detection means the server is compromised, and the attacker has (or had) root.

  1. Don’t trust the system’s own tools any more. They may be replaced.
  2. Isolate the server: restrict network access via the firewall or provider panel, and keep the console available.
  3. Preserve evidence if needed: copy logs off the server.
  4. Rebuild from scratch. Reinstall the OS (VPS.DO’s control panel has a one-click OS reinstall), restore data from backups made before the compromise, patch the entry point, and rotate all passwords, SSH keys and API tokens.

Cleaning a rootkit in place is unreliable. Reinstalling is the safe answer.

Limitations

  • Both tools mainly detect known rootkits and simple anomalies. Modern kernel-level or fileless malware can evade them.
  • A rootkit installed before the baseline was created is “normal” to rkhunter.
  • Running scanners on a compromised system is weaker than checking from outside (offline disk inspection).

Combine them with stronger measures: file integrity monitoring (AIDE), audit logging (auditd), a hardening audit (Lynis), central logging, and most importantly prevention: updates, key-only SSH and minimal exposed services. See Linux server hardening.

Quick reference

Task Command
Update data rkhunter --update
Create baseline rkhunter --propupd
Check rkhunter --check --sk --rwo
Log /var/log/rkhunter.log
chkrootkit chkrootkit -q
Verify package files dpkg -V pkg / rpm -V pkg

Related: ClamAV and Fail2Ban.

  • Security
  • Linux
  • Malware