How to Install chkrootkit on Ubuntu

chkrootkit (Check Rootkit) is a classic Unix rootkit scanner: a shell script plus helper binaries that look for known rootkit signatures, tampered system commands, suspicious kernel modules, and packet sniffers. It is not a replacement for antivirus or intrusion detection, but it is a useful second opinion on servers you already harden with updates and firewall rules.

This guide covers how to install chkrootkit on Ubuntu from apt, run scans without waiting forever on a full-system walk, enable packaged daily checks, and read results without panicking over common false positives.

Quick command summary

Prerequisites

• Root privileges for meaningful scans—chkrootkit compares live /bin, /sbin, and process tables.
• Patience or timeout for full scans; a quiet scan on my host finished within ~90 seconds, while an unrestricted full run can exceed ten minutes on a busy disk.
• Optional companion: rkhunter rootkit scanner guide for overlapping coverage.

Confirm your LTS or interim release with our check Ubuntu version guide when the steps below name a specific Ubuntu codename.

What chkrootkit actually scans

chkrootkit does not recursively virus-scan every file like ClamAV. It runs a fixed battery of rootkit-specific tests. The long runtime comes from external commands, strings comparisons, and hidden-file discovery under large trees like /usr/lib.

Step 1: Install chkrootkit from apt

Refresh indexes and install from Universe:

sudo apt update
sudo apt install -y chkrootkit

On Ubuntu 25.04:

apt-cache policy chkrootkit

Installed: 0.58b-4
Candidate: 0.58b-4
     0.58b-4 500
        500 http://archive.ubuntu.com/ubuntu plucky/universe amd64 Packages

Verify the binary:

chkrootkit -V

chkrootkit version 0.58b

Step 2: Run your first scan (with a timeout)

Quiet mode (recommended day to day)

timeout 300 sudo chkrootkit -q

On my Ubuntu 25.04 host the quiet scan reported warnings, not INFECTED, for dotfiles owned by normal packages:

WARNING: The following suspicious files and directories were found:
/usr/lib/modules/6.14.0-37-generic/vdso/.build-id [From Debian package: linux-modules-6.14.0-37-generic]
/usr/lib/node_modules/npm/.npmrc [From Debian package: nodejs]
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest/.htaccess [From Debian package: fail2ban]

The [From Debian package: …] suffix on Ubuntu 0.58b means dpkg owns the path—treat these as false positives unless other evidence contradicts it. Confirm with:

Find which package owns a file with dpkg -S; the dpkg command documents search syntax and common library lookups.

dpkg -S /usr/lib/modules/6.14.0-37-generic/vdso/.build-id

Full verbose scan (expect a long run)

timeout 600 sudo chkrootkit 2>&1 | tee /tmp/chkrootkit-full.log

The first lines show the live root:

ROOTDIR is `/'
Checking `amd'...                                           not found
Checking `basename'...                                      not infected
Checking `chfn'...                                          not infected
Checking `sshd'...                                          not infected

• not infected — test passed for that binary/signature.
• not found — target not installed (common for legacy daemons).
• not tested — skipped (missing helper or irrelevant on this system).
• INFECTED — investigate immediately, but verify with package checksums before assuming compromise.

Single-test and scoped scans (fast)

sudo chkrootkit sshd

ROOTDIR is `/'
Checking `sshd'...                                          not infected

Scan only an alternate directory (for example a mounted suspect disk):

sudo chkrootkit -r /opt

ROOTDIR is `/opt/'
Checking `basename'...                                      not found

List every test name:

chkrootkit -l | fold -s | head -5

/usr/sbin/chkrootkit: tests: aliens asp bindshell lkm rexedcs sniffer ...

Step 3: Enable and tune daily scans

Ubuntu 25.04 ships both a systemd timer and a legacy cron script:

Enable or disable the unit at boot with systemctl enable; the systemctl command documents enable --now, symlinks under /etc/systemd/system, and masks.

systemctl is-enabled chkrootkit.timer
systemctl is-active chkrootkit.timer
ls -la /etc/cron.daily/chkrootkit

enabled
active
-rwxr-xr-x 1 root root 161 ... /etc/cron.daily/chkrootkit

Configuration moved to /etc/chkrootkit/chkrootkit.conf (not /etc/chkrootkit.conf as older tutorials state):

grep -E '^RUN_DAILY|^RUN_DAILY_OPTS|^DIFF_MODE|^MAILTO' /etc/chkrootkit/chkrootkit.conf

Default highlights from the packaged file:

RUN_DAILY="true"
RUN_DAILY_OPTS=""
DIFF_MODE="true"

For quieter daily mail, set:

sudo sed -i 's/^RUN_DAILY_OPTS=.*/RUN_DAILY_OPTS="-q"/' /etc/chkrootkit/chkrootkit.conf

Review the first automated run:

sudo less /var/log/chkrootkit/log.today

When output is clean, establish a baseline for diff mode:

sudo cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected

Add reviewed false positives to /etc/chkrootkit/chkrootkit.ignore.

Optional cron wrapper with timeout

If you schedule a custom cron job instead of the packaged timer, always cap runtime:

sudo tee /usr/local/bin/chkrootkit-safe.sh << 'EOF'
#!/bin/sh
timeout 900 /usr/sbin/chkrootkit -q >> /var/log/chkrootkit/manual.log 2>&1
EOF
sudo chmod +x /usr/local/bin/chkrootkit-safe.sh

Step 4: Interpret warnings and false positives

PACKET SNIFFER warnings often need socket context—use ss -lp to see which process holds PF_PACKET sockets; see the ss command for filtering by protocol.

If you suspect a real rootkit, do not trust local ps and ls alone—boot trusted live media and scan the mounted root read-only (see ps command for snapshots on clean media):

sudo chkrootkit -r /mnt/suspect-root

Pair results with rkhunter for broader file-property checks.

Uninstall

sudo systemctl disable --now chkrootkit.timer
sudo apt purge -y chkrootkit
sudo apt autoremove -y

Remove logs when you no longer need history:

sudo rm -rf /var/log/chkrootkit

The general how to uninstall packages on Ubuntu covers cases where this package was installed through a different method.

Troubleshooting

References

• chkrootkit project — upstream documentation
• Ubuntu chkrootkit package — version per release
• Alibaba Cloud: chkrootkit on Ubuntu — classic apt workflow (config path differs on newer Ubuntu)
• OneUptime: rkhunter and chkrootkit — pairing scanners and false-positive handling
• ,

Summary

Install chkrootkit on Ubuntu with sudo apt install chkrootkit from Universe—it delivered 0.58b on 25.04. A default sudo chkrootkit is a full live-system rootkit audit (ROOTDIR=/), not a quick malware click; that is why earlier test runs looked stuck until we added timeout and switched to -q for routine checks.

Use chkrootkit -q day to day, chkrootkit sshd (or other single tests) for spot checks, and chkrootkit -r when you scan a mounted disk offline. chkrootkit.timer handles daily runs on current Ubuntu—tune /etc/chkrootkit/chkrootkit.conf so mail stays readable. Treat package-tagged warnings as leads to verify, not automatic proof of compromise.