How to Install and Use rkhunter on Linux for Rootkit Scanning

How to Install and Use rkhunter on Linux for Rootkit Scanning

Published on: April 5, 2025

📢 Introduction: Linux Security and Rootkits

Linux systems are known for their robust security features. However, malicious software such as rootkits can compromise even the most secure environments by operating at the kernel level.

In this guide, you’ll learn how to install and use rkhunter (Rootkit Hunter), a powerful open-source tool designed to detect rootkits, backdoors, and local exploits on Linux systems.

🔍 What is rkhunter?

rkhunter (Rootkit Hunter) is an open-source security tool used to scan Linux systems for signs of rootkits, backdoors, and other security vulnerabilities. It works by checking system binaries, files, and processes for known signatures of malicious software.

🧰 How to Install rkhunter on Debian/Ubuntu-Based Systems

Follow these steps to easily install rkhunter on your Linux system:

Step 1: Update Package List

sudo apt update

Step 2: Install rkhunter

sudo apt install rkhunter -y

Step 3: Update rkhunter Database

sudo rkhunter --update

🔍 How to Perform a Rootkit Scan with rkhunter

1. Basic Scan (Quick Check)

sudo rkhunter --check

2. Full System Scan (All Checks)

sudo rkhunter --check --sk

–sk stands for “skip all prompts” — this runs the scan automatically.

3. Scan Specific Sections Only

sudo rkhunter --check --system-language en --skip-keypress --enable all --disable none

📋 How to Read rkhunter Scan Results

After the scan completes, you may see output like this:

[Rootkit Hunter version 1.4.6]

Checking system for rootkits...

Possible rootkit installed: Possible Linux/Ebury - Based SSH Trojan

Common Warnings and Their Meanings

🧪 How to View rkhunter Logs

rkhunter saves all scan results in a log file. You can view it with the following command:

cat /var/log/rkhunter/rkhunter.log

🧹 Post-Scan Actions

If rkhunter detects a potential threat:

1. Verify the results: Confirm whether the warning is a false positive or a real threat.
2. Close security gaps: Update outdated software and disable unnecessary services.
3. Run additional scans: Use tools like chkrootkit for cross-verification.
4. Reinstall the system: If a serious threat is found, consider a fresh OS installation.

🧩 Additional Security Tools

1. Run chkrootkit for Extra Scanning

sudo apt install chkrootkit -y
sudo chkrootkit

2. Check System Logs

journalctl -xe

3. Inspect Network Connections

ss -tulnp

📝 Summary

📚 Resources

• rkhunter GitHub Page
• rkhunter Official Documentation