Rkhunter (Rootkit Hunter) is a tool that scans the system for rootkits, backdoors, and possible local exploits. It is a free and open-source security tool that runs on Linux and Unix-like systems. This guide shows how to install and configure Rkhunter on Ubuntu/Debian.
Starting from the system update and upgrade:
sudo apt update
sudo apt upgrade
To install Rkhunter, use:
sudo apt install rkhunter
To check the installed version:
rkhunter --version
Output example:
To configure Rkhunter, use:
sudo nano /etc/rkhunter.conf
It opens the Rkhunter configuration file with the Nano editor.
Description of some options you can set in the Rkhunter configuration file:
UPDATE_MIRRORS: This option enables Rkhunter to update its database of known rootkits and malware. Set this option to1.CRON_DAILY_RUN: This option enables Rkhunter to run daily scans of your system. Set this option totrue.REPORT_EMAIL: This option sets the email address to which Rkhunter will send daily scan reports. Set this option to your email address.ALLOW_SSH_ROOT_USER: This option allows Rkhunter to scan the root user’s SSH files. Set this option tono.ALLOW_SSH_PROT_V1: This option allows Rkhunter to scan SSH version 1 files. Set this option to2.ALLOW_SYSLOG_REMOTE: This option allows Rkhunter to scan remote syslog servers. Set this option tono.USE_SYSLOG: This option enables Rkhunter to log its activity to the system log. Set this option toauthpriv.notice.
Before running a scan, update the Rkhunter database:
sudo rkhunter --update
To start the Rkhunter scan of your system for potential rootkits or malware:
sudo rkhunter --check
Output example:
To open the Rkhunter report in the edit (Nano):
sudo nano /var/log/rkhunter.log
Output example:
Create a file called rkhunter.sh under /etc/cron.daily/, which then scans your file system every day and sends email notifications to your email id. Create the following file:
nano /etc/cron.daily/rkhunter.sh
Add the following lines of code to it and replace "YourServerNameHere" with your "Server Name" and "[email protected]" with your "Email":
#!/bin/sh
(
/usr/local/bin/rkhunter --versioncheck
/usr/local/bin/rkhunter --update
/usr/local/bin/rkhunter --cronjob --report-warnings-only
) | /bin/mail -s 'rkhunter Daily Run (PutYourServerNameHere)' [email protected]
Set execute permission on the file:
chmod 755 /etc/cron.daily/rkhunter.sh
For more information and options, please run the following command:
sudo rkhunter --help
Conclusion
Rkhunter is an effective tool for identifying potential security risks on your system.