Detect Rootkits on Linux with rkhunter

Rootkit Hunter (rkhunter) compares your system against known rootkit signatures, suspicious ports, and (after you baseline it) stored file properties. Install steps differ by distribution; everything after that is the same rkhunter workflow.

Use one generic guide: a short install section per package family, then shared update → propupd → check → log steps tested on RHEL (vm1.lab.example) and Debian (apt install in a bookworm container).

What rkhunter checks

rkhunter is a shell-based scanner that looks for:

• Known rootkit files and directories
• Listening ports associated with backdoors
• Changes to system binaries compared with a baseline you store
• Basic misconfigurations such as SSH settings that disagree with /etc/rkhunter.conf

It does not remove malware. It reports warnings so you can investigate.

Install on RHEL, Rocky Linux, AlmaLinux, and Fedora

On RHEL 10 the package comes from EPEL. Enable EPEL if it is not already present — see install EPEL on RHEL family when you need the full steps.

Install rkhunter with dnf:

sudo dnf install -y rkhunter

Sample output:

Installed:
  rkhunter-1.4.6-31.el10_2.noarch
Complete!

Confirm the package and version:

rkhunter --version

Sample output:

Rootkit Hunter 1.4.6

That NEVRA and version string confirm the EPEL build this guide uses on RHEL 10.

Install on Debian and Ubuntu

On Debian and Ubuntu, install from the distribution repository with apt. Refresh package indexes first:

sudo apt update

Install the scanner package:

sudo apt install -y rkhunter

The Debian package post-install script can run an initial rkhunter --propupd automatically. You still follow the baseline and check steps below so you know what landed on disk.

Verify the package:

dpkg -l rkhunter

Sample output:

ii  rkhunter  1.4.6-11  all  rootkit, backdoor, sniffer and exploit scanner

Update rootkit signatures

Refresh rkhunter data files when the host can reach the upstream mirrors:

sudo rkhunter --update

Sample output when the updater cannot download new data files:

Checking file mirrors.dat                                  [ Update failed ]
Checking file programs_bad.dat                             [ Update failed ]
Checking file backdoorports.dat                            [ Update failed ]
Checking file suspscan.dat                                 [ Update failed ]
Checking file i18n versions                                [ Update failed ]

Please check the log file (/var/log/rkhunter/rkhunter.log)

rkhunter --update needs access to its configured update sources. Proxy restrictions, DNS or network problems, WEB_CMD, mirror configuration in /etc/rkhunter.conf, or upstream availability can cause update failures.

Scans still run using databases shipped with the package under /var/lib/rkhunter/db/. Treat failures as a maintenance item — fix network or proxy access, adjust mirrors, or install a vendor package refresh when the bundled data is stale.

On Debian, if --update prints Invalid WEB_CMD configuration option, check WEB_CMD in /etc/rkhunter.conf (some defaults set it to /bin/false to block web downloads).

Baseline file properties with --propupd

Before you trust file-change warnings, store properties for system binaries on a known-good system:

sudo rkhunter --propupd

Sample output:

[ Rootkit Hunter version 1.4.6 ]
File created: searched for 177 files, found 134

rkhunter writes rkhunter.dat under /var/lib/rkhunter/. Later checks compare live files against that baseline. Run --propupd only after you have verified that the changed files are legitimate. Package upgrades commonly change binaries, but confirm those changes with the package manager before updating the rkhunter baseline.

Run a rootkit check

Interactive rkhunter -c pauses for Enter between sections. For scripting and this walkthrough, use a non-interactive check that prints warnings only:

sudo rkhunter --check --skip-keypress --report-warnings-only --nocolors

A full run on vm1.lab.example took about six minutes after the baseline step above. The lab host still reported policy warnings (SSH settings, empty backdoor-port data when --update failed) but Possible rootkits: 0 in the log summary.

Read warnings in the log file

Detailed output lands in /var/log/rkhunter/rkhunter.log. List recent warnings:

sudo grep -i warning /var/log/rkhunter/rkhunter.log | tail -10

Read the summary block at the end of the last run:

sudo grep -A6 'System checks summary' /var/log/rkhunter/rkhunter.log | tail -8

Sample output:

System checks summary
=====================

File properties checks...
    Files checked: 134
    Suspect files: 0

Rootkit checks...
    Rootkits checked : 476
    Possible rootkits: 0

Possible rootkits: 0 means rkhunter did not flag a possible rootkit in those checks. It does not prove the system is clean — read other warnings in the log and treat rkhunter as one integrity check, not a full incident-response verdict.

Common warnings and false positives

Schedule regular checks (optional)

For unattended scans, --cronjob implies non-interactive checking, including --check, --nocolors, and --skip-keypress. Combine it with --report-warnings-only when you only want warnings in job output. Wire the command into cron or a systemd timer after you have tested the same flags manually.

Troubleshooting

References

• rkhunter(8) — Rootkit Hunter manual
• rkhunter project documentation
• Red Hat — Scanning the system for malware and malicious activity

Summary

Use one generic rkhunter article for Linux: install with dnf and EPEL on RHEL family hosts, install with apt on Debian and Ubuntu, then run the same maintenance commands everywhere. Update signatures when the network allows, run --propupd once on a trusted baseline, and scan with rkhunter --check --skip-keypress --report-warnings-only.

Read /var/log/rkhunter/rkhunter.log for the summary and grep warnings before you treat a hit as a rootkit — wrapper scripts, SSH settings, and failed updates generate noise. For a second opinion on Ubuntu, pair this with chkrootkit; for malware scanning, see ClamAV on RHEL family.