Rkhunter tutorial – Protect your PC
Tags: cybersecurity, rootkits, security, tutorial
Published: 2023-11-01 22:57:16

In an age where cybersecurity is a daily concern, you have to protect yourself. And that's what we are going to do with Rkhunter.

Let's remove rootkits, backdoors and other exploits from your PC.

<table><tbody><tr><td><strong><span style="text-decoration: underline;">Table of contents</span></strong></td></tr><tr><td><a href="#intro">Introduction</a></td></tr><tr><td><a href="#installation">Installation</a></td></tr><tr><td><a href="#running">Running Rkhunter</a></td></tr><tr><td><a href="#resources">Resources</a></td></tr></tbody></table>

## Introduction: What is Rkhunter?

But first of all, let's learn what Rkhunter is and what can it do for us.

Rkhunter is a tool that scans your computer for rootkits, backdoors, [vulnerabilities](https://letslearnabout.net/hacking/from-zero-to-hero/day-051-vulnerabilities-101/), and local exploits. And, in case you don't know:

- A **rootkit** enables access to a computer. It stays at the root (hence the name, _root_ and _kit_) and gives remote access and control to a malicious person. Nothing you want to do.

- A **backdoor** can let a hacker bypass any security system. Firewalls, antivirus, etc mean nothing once a backdoor has been established.

- A **vulnerability** is a flaw in a computer system that can be taken advantage of.

- And, finally, **exploits** are pieces of software that can take advantage of existing bugs, errors or vulnerabilities in a system. From taking your bank data to stealing your passwords, and encrypting your data... anything is possible.

You don't want this. And, to solve it, we are going to use Rkhunter, a great and easy-to-use tool.

## Installation

To install Rkhunter, first update your Linux packages list, then install Rkhunter:

_sudo apt-get update
sudo apt-get install rkhunter_

Shortly, you will be prompted with this screen:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8xovpgzgfsa6snrwhqy3.png)

I picked _Local only,_ but if you want to get emails from Rkhunter, select your preferred option and configure it.

After everything is installed, check that Rkhunter is properly installed:

_rkhunter -V_

As I'm running this code on October 2023, I got the following message:

Rootkit Hunter 1.4.6

You may have a newer version. But now, let's configure it.

_vim /etc/rkhunter.conf_

And change the following lines:

`107  UPDATE\_MIRRORS=1
122  MIRRORS\_MODE=0
1190 WEB\_CMD=""`

We set up the mirror options to let Rkhunter update. Let's update it now:

_sudo rkhunter --update
sudo rkhunter --propupd_

Everything should be set up now, as we have updated everything. Time for the fun stuff.

### Running Rkhunter

To run Rkhunter, simply run:

_sudo rkhunter --check_

First, it will check general, shareable files in the /usr/ directory. After that, it will check for known rootkits (remember to update before running Rkhunter!), then, additional rootkit checks, malware checks, Linux-specific checks, your network and local host, etc.

At the end, you'll be prompted with a summary:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a5a1ox3rhl6vbyouwnkq.png)

Luckily, you won't have any warning, but I do. I'm going to run again the check with a special flag:

_sudo rkhunter --check --rwo_

This will run Rkhunter silently, only displaying any warning messages, in case it finds one or more of them.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hm1nqsdp62hx977viu6n.png)

Compared to the previous command, this one is way less verbose.

The only warnings I have are the ones regarding _lwp-request_, a false positive that gets flagged because it allows making HTTP requests, and an SSH misconfiguration. But nothing major.

P.S. If you don't want to get a warning every time on safe files you run Rkhunter, you can add this to your _/etc/rkhunter.conf_ file:

_SCRIPTWHITELIST=/usr/bin/lwp-request_

Keep running Rkhunter from time to time to keep your computer safe and rootkit free :)

## Resources

[Rkhunter docs](https://docs.rockylinux.org/)

[What is a rootkit?](https://www.veracode.com/security/rootkit)

[Vulnerabilities](https://letslearnabout.net/hacking/from-zero-to-hero/day-051-vulnerabilities-101/)

[Original post: Rkhunter tutorial](https://letslearnabout.net/hacking/rkhunter-tutorial/)