How to Install chkrootkit on Ubuntu

A rootkit is malware or a set of modifications designed to keep privileged access while hiding processes, files, or other signs of compromise.

chkrootkit is a second-opinion rootkit scanner that looks for known signatures and suspicious system behavior: tampered binaries, odd kernel modules, hidden files, and packet sniffers. It reports what it finds; it does not remove rootkits. A clean-looking run is not proof the host is safe, and it is not a substitute for patching, logging, or AV where you need file scanning (see does Ubuntu need antivirus? for that decision).

This guide installs chkrootkit on Ubuntu 26.04, 24.04, and 22.04 from apt, runs your first scan, configures packaged daily scans, and explains how to read results without mistaking package ownership labels—or exit code 0—for a clean bill of health.

Quick Answer

Install from Universe and run a quiet scan:

sudo apt update && sudo apt install -y chkrootkit

Run a quiet scan that hides clean test lines:

sudo chkrootkit -q

Confirm the package and timer:

chkrootkit -V

chkrootkit version 0.58b

Check that the packaged daily timer is loaded:

systemctl status chkrootkit.timer --no-pager

Use sudo chkrootkit -q for routine review. Do not wrap everyday scans in timeout unless you accept that an expired timeout means the scan did not finish.

chkrootkit Versions on Ubuntu

Ubuntu package vs upstream 0.59

The chkrootkit project released 0.59 upstream (January 2026) with additional checks and fixes. Ubuntu 24.04 and 26.04 still package 0.58b in Universe.

APT remains the right default for day-to-day use because you get Ubuntu integration:

• /etc/chkrootkit/chkrootkit.conf and chkrootkit.ignore
• chkrootkit.service / chkrootkit.timer and /etc/cron.daily/chkrootkit
• Package updates and Ubuntu package lifecycle through apt (Universe; not the same as guaranteed Canonical security support for every component)

Upstream source is useful when you need the newest test names only in 0.59—see Optional: run upstream chkrootkit 0.59 at the end.

What chkrootkit Can and Cannot Detect

chkrootkit runs a fixed set of tests against the live system (ROOTDIR=/ by default). It is not a full-disk antivirus scan like ClamAV.

Treat warnings as leads to investigate, not automatic confirmation of compromise or safety.

Install chkrootkit on Ubuntu

Install from the Universe repository

Universe is one of Ubuntu’s standard software repository components. It is enabled on most desktop installs; if apt cannot find chkrootkit, enable it with sudo add-apt-repository universe and run sudo apt update.

Refresh indexes and install the package:

sudo apt update && sudo apt install -y chkrootkit

On 26.04, confirm the candidate:

apt-cache policy chkrootkit

Installed: 0.58b-6build1
Candidate: 0.58b-6build1
     0.58b-6build1 500
        500 http://in.archive.ubuntu.com/ubuntu resolute/universe amd64 Packages

Why you may see a mail server configuration prompt

The Ubuntu package recommends a mail transport agent and bsd-mailx because daily scans can email results to root when MAILTO is set in chkrootkit.conf.

Manual scans do not require you to run a mail server. If the Postfix configuration dialog appears during install and you are not setting up mail alerts, choosing No configuration (or equivalent) is reasonable for a workstation or server that will not deliver local root mail.

Verify the installed version

Print the packaged upstream version string:

chkrootkit -V

chkrootkit version 0.58b

The binary lives at /usr/sbin/chkrootkit. The package name is chkrootkit, not chrootkit.

Run Your First Rootkit Scan

Run live-system scans with sudo (or as root) because many checks need process tables, kernel interfaces, networking state, and protected paths a normal user cannot fully inspect.

A default sudo chkrootkit walks dozens of tests across the running system. That can take many minutes on a busy host with little console output between lines.

Full scan

Run the verbose scan when you need every not infected line for documentation:

sudo chkrootkit 2>&1 | tee /tmp/chkrootkit-full.log

The transcript starts with the active root:

ROOTDIR is `/'
Checking `amd'...                                           not found
Checking `basename'...                                      not infected
Checking `sshd'...                                          not infected

not found means the target is not installed; not tested means a helper was missing or the check was skipped.

Quiet scan for easier review

-q does not make tests faster. It suppresses output for tests with no suspicious result so you can focus on warnings and INFECTED lines.

sudo chkrootkit -q

On my 26.04 host, quiet mode still listed packaged dotfiles:

WARNING: The following suspicious files and directories were found:
/usr/lib/modules/7.0.0-38-generic/vdso/.build-id [From Debian package: linux-modules-7.0.0-38-generic]
/usr/lib/debug/.build-id [From Debian package: libc6-dbg:amd64]

Budget several minutes for a full quiet run on a loaded system. If you must cap runtime for automation, see chkrootkit takes a long time to finish.

Run a single chkrootkit test

Spot-check one signature without waiting for the full suite:

sudo chkrootkit sshd

ROOTDIR is `/'
Checking `sshd'...                                          not infected

List all test names:

chkrootkit -l

/usr/sbin/chkrootkit: tests: aliens asp bindshell lkm rexedcs sniffer w55808 ...

Scan a mounted alternate root filesystem

-r sets an alternate root directory for offline forensics—not a generic “scan this folder” pass. chkrootkit treats that path as / for the test battery.

Mount the suspect disk read-only, then point at the mount:

sudo chkrootkit -r /mnt/suspect-root

ROOTDIR is `/mnt/suspect-root/'
Checking `basename'...                                      not found

Use a dedicated mount such as /mnt/suspect-root, not arbitrary paths like /opt, unless you intend that directory to act as the root filesystem for the scan.

Understand chkrootkit Results

     chkrootkit reports a warning
                 |
                 v
        Can you explain it?
            /           \
          yes            no
           |              |
           v              v
   Verify package    Treat as suspicious
   ownership/checksum      |
           |              v
           v         Preserve logs;
   Document known     isolate if needed
   false positive          |
           |              v
           |         Investigate from
           |          trusted media
           v
        (done)

not infected

The test did not match a known rootkit pattern for that target. It does not scan every file on the system.

INFECTED

Stop and investigate—do not delete binaries immediately. Confirm package ownership, compare integrity, and gather independent evidence.

On Ubuntu 26.04, chkrootkit may flag core utilities as INFECTED when /usr/bin/basename and similar commands come from uutils (coreutils-from-uutils) instead of traditional GNU paths. That is a tool mismatch, not automatic proof of malware—verify with dpkg -S and your change-management records.

Example from the lab (uutils layout):

Checking `basename'...                                      INFECTED

Ask dpkg which package provides that binary:

dpkg -S /usr/bin/basename

coreutils-from-uutils: /usr/bin/basename

PACKET SNIFFER

This means a process uses a PF_PACKET socket. Monitoring tools, NetworkManager, and tcpdump can trigger it. Inspect listeners with the ss command:

ss -lp | grep PACKET

Package-owned suspicious files

A [From Debian package: …] ownership label means dpkg knows which package owns the path. It does not prove the file on disk still matches the packaged checksum.

dpkg -S /usr/lib/modules/7.0.0-38-generic/vdso/.build-id

Use the dpkg command for ownership queries. For content verification, install and run debsums on the owning package when you need checksum proof.

Why exit code 0 does not mean the system is clean

Debian and Ubuntu’s packaged chkrootkit script exits 0 at the end even when individual tests print INFECTED or WARNING lines.

Do not wire monitoring to exit status alone. Parse /var/log/chkrootkit/log.today or the scan transcript for INFECTED and WARNING.

Example: basename reported INFECTED while the shell still returned success:

sudo chkrootkit basename; echo exit:$?

Checking `basename'...                                      INFECTED
exit:0

Configure Automatic Daily Scans

Ubuntu 24.04 and 26.04 ship a systemd timer and /etc/cron.daily/chkrootkit. The cron helper exits immediately when /run/systemd/system exists, so the daily job does not run twice on a normal systemd boot. Prefer the packaged timer on current releases—do not add your own cron wrapper on top.

On 22.04, the same package layout may apply, but some hosts never had chkrootkit.timer enabled or the unit may be missing on minimal images. If systemctl status chkrootkit.timer reports Unit chkrootkit.timer could not be found, rely on the packaged /etc/cron.daily/chkrootkit script (it calls chkrootkit-daily when executable). Manual scans and /etc/chkrootkit/chkrootkit.conf work the same; only the scheduler differs.

Verify the chkrootkit systemd timer

Confirm the timer unit is enabled at boot:

systemctl is-enabled chkrootkit.timer

enabled

Confirm the timer is currently active:

systemctl is-active chkrootkit.timer

active

Daily schedule details:

systemctl cat chkrootkit.timer

[Timer]
OnCalendar=daily
Persistent=true

Enable the timer immediately after install if it is not already active (systemctl enable --now):

sudo systemctl enable --now chkrootkit.timer

Configure RUN_DAILY, DIFF_MODE, and MAILTO

Edit the packaged config (not legacy /etc/chkrootkit.conf):

grep -E '^RUN_DAILY|^RUN_DAILY_OPTS|^DIFF_MODE|^MAILTO' /etc/chkrootkit/chkrootkit.conf

RUN_DAILY="true"
RUN_DAILY_OPTS=""
DIFF_MODE="true"
MAILTO="root"

Do not set RUN_DAILY_OPTS="-q" for everyone: with DIFF_MODE=true, leaving full output can make diffs easier to read while unchanged lines are suppressed in comparisons.

Apply edits with:

sudo nano /etc/chkrootkit/chkrootkit.conf

Create a known-good baseline

A baseline is a saved copy of scan output you already reviewed as expected. With DIFF_MODE="true", the daily job compares new runs against /var/log/chkrootkit/log.expected and highlights changes.

Review the first daily log only after you are confident the system is in a known-good state:

sudo less /var/log/chkrootkit/log.today

Copy it to the expected baseline:

sudo cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected

Copying log.today from an already compromised host would bake malicious state into the baseline.

Ignore reviewed false positives

Add stable paths you have verified to /etc/chkrootkit/chkrootkit.ignore so daily diffs stay readable.

Optional: Run upstream chkrootkit 0.59

Use upstream 0.59 when you need checks that are not in Ubuntu’s 0.58b package. Build in a temporary directory and run ./chkrootkit from that directory so you do not shadow /usr/sbin/chkrootkit or break the Ubuntu timer.

Install build tools and a downloader (minimal servers often lack curl):

sudo apt install -y build-essential curl

Download the 0.59 source tarball. The link below is Debian’s mirror of the official upstream 0.59.orig.tar.gz (same content as the release on chkrootkit.org); use it for a simple HTTPS fetch:

cd /tmp && curl -fsSL -o chkrootkit-0.59.tar.gz https://deb.debian.org/debian/pool/main/c/chkrootkit/chkrootkit_0.59.orig.tar.gz

Extract and build:

tar -xzf chkrootkit-0.59.tar.gz && cd chkrootkit-0.59 && make -s

chkrootkit version 0.59

Run from the build tree (keep APT as the managed daily scanner):

sudo ./chkrootkit -q

If the script complains about netstat, install net-tools or rely on the Ubuntu package for scheduled scans.

Investigate a Possible Rootkit Safely

Verify package ownership and integrity

1. dpkg -S /path — which package owns the file?
2. debsums -s package — do on-disk files match package checksums? (install the debsums package if needed.) On a host you already believe is compromised, do not treat local checksum tools as absolute proof.
3. Compare with a second tool such as rkhunter—the two overlap but do not cover identical checks.

Scan from trusted media when compromise is credible

Do not trust local ps, ls, or chkrootkit results alone on a host you believe is rooted. Boot trusted live media, mount the root filesystem read-only, and run:

sudo chkrootkit -r /mnt/suspect-root

The ps command on clean media helps compare process lists against what the suspect system reported.

Update chkrootkit

Ubuntu delivers fixes through apt:

sudo apt update && sudo apt install --only-upgrade chkrootkit

Upstream 0.59 does not replace apt updates—rebuild from a newer tarball only when you deliberately need upstream tests.

Uninstall chkrootkit

Stop scheduled scans:

sudo systemctl disable --now chkrootkit.timer

Remove the package:

sudo apt purge -y chkrootkit

Preview orphaned dependencies:

sudo apt-get -s autoremove

Remove only packages you no longer need. See how to remove software on Ubuntu for the full removal workflow.

Optional log cleanup (do not delete scan history or log.expected while you are investigating a suspected compromise—preserve logs first):

sudo rm -rf /var/log/chkrootkit

Troubleshooting

Confirm your release with check Ubuntu version when comparing package versions.

chkrootkit takes a long time to finish

Full scans can exceed ten minutes. timeout does not speed tests up—it stops them. Exit code 124 from timeout means chkrootkit was interrupted; partial output is not a completed clean scan.

For bounded automation only:

sudo timeout 15m chkrootkit -q

Interpret timeout exits as incomplete, not as “no rootkit found.”

Summary

Install chkrootkit on Ubuntu 26.04, 24.04, or 22.04 with sudo apt install chkrootkit from Universe, then use sudo chkrootkit -q for readable routine scans. On 24.04 and 26.04, prefer chkrootkit.timer and /etc/chkrootkit/chkrootkit.conf over custom cron wrappers or default timeout wrapping; on 22.04, use the packaged daily cron helper when the timer unit is missing.

Read [From Debian package: …] as package ownership metadata, not integrity proof. INFECTED deserves investigation, but on 26.04 uutils coreutils can produce false INFECTED lines on standard utilities. exit 0 does not clear the host—review log output and consider offline chkrootkit -r on mounted roots when compromise is plausible.

Upstream 0.59 is optional for newer checks; keep apt as the maintained daily scanner unless you accept manual rebuilds.

References

• chkrootkit project — upstream releases and documentation
• chkrootkit man page (Ubuntu) — options including -q and -r
• Ubuntu chkrootkit source package — versions per Ubuntu release