How to Install Rootkit Hunter in Linux
Tags: rootkit, linux, linuxsecurity, hostnextra
Published: 2021-05-03 07:34:17

In this article, we'll explain how to install Rootkit Hunter in Linux (rkhunter).

<a href="https://sourceforge.net/projects/rkhunter/" target="_blank" rel="noopener">Rootkit Hunter</a> is an open-source Unix/Linux based security monitoring and analyzing tool. It is a shell script which carries out various checks on the local system to try and detect known rootkits and malware. It also performs checks to see if commands have been modified, if the system startup files have been modified, and various checks on the network interfaces, including checks for listening applications.

This guide will help you with the installation and configuration process.

<a href="https://www.hostnextra.com/kb/how-to-install-rootkit-hunter-in-linux/">Install Rootkit Hunter in Linux</a>

Let's get started.

<h4>1. Download Rkhunter</h4>
Use following command to download Rkhunter from sourceforge.net.
<blockquote># cd /tmp

# wget http://downloads.sourceforge.net/project/rkhunter/rkhunter/1.4.6/rkhunter-1.4.6.tar.gz</blockquote>
For latest version visit <a href="https://sourceforge.net/projects/rkhunter/files/rkhunter/" target="_blank" rel="noopener">https://sourceforge.net/projects/rkhunter/files/rkhunter/</a>
<h4>2. Extract and install Rkhunter</h4>
After we download Rkhunter, extract it and run the installation script like shown below:
<blockquote># tar -xvf rkhunter-1.4.6.tar.gz
# cd rkhunter-1.4.6

# ./installer.sh --install</blockquote>
Above script will perform default installation of Rkhunter.

<img class="alignnone size-full wp-image-2194" src="https://www.hostnextra.com/kb/wp-content/uploads/2021/04/install-rkhunter-on-linux.png" alt="install Rkhunter on Linux" width="716" height="651" />

Note: If some form of file permission error is shown, then check that the 'installer.sh' script is executable.

The installer also has a help option:
<blockquote># ./installer.sh --help</blockquote>
The default installation process will install a configuration file, called 'rkhunter.conf', into the '/etc' directory or where you chose using the '--layout' switch. You can either edit the main configuration file itself, or create a 'local' configuration file for your own settings. This file, which must be called 'rkhunter.conf.local', must reside in the same directory as the main configuration file.

Alternatively, or in addition if wished, you can create a directory, named 'rkhunter.d', in the same directory as the main configuration file. Within 'rkhunter.d' you can then create further configuration files. The only restriction is that the file names end in '.conf'.

You should edit the configuration file(s) according to your own system requirements.
<h4>3. Update Rkhunter</h4>
<blockquote># rkhunter --update</blockquote>
Before running RKH we will need to fill the file properties database by running the following command:
<blockquote># rkhunter --propupd</blockquote>
<h4>4. Run Rkhunter</h4>
To scan the entire file system, run following command as a root user:
<blockquote># rkhunter -c</blockquote>
The above command generates a log file under <em><strong>/var/log/rkhunter.log</strong></em> with the check results made by Rkhunter.
<blockquote># cat /var/log/rkhunter.log</blockquote>
Check only warnings using following command:
<blockquote># grep Warning /var/log/rkhunter.log</blockquote>
Check man page.
<blockquote># man rkhunter</blockquote>
That's we have covered basic installation and configuration of Rkhunter.

In this article, we've seen how to install Rootkit Hunter in Linux (rkhunter).

Check out our high performance <a href="https://www.hostnextra.com/dedicated-server.html" target="_blank" rel="noopener">dedicated servers</a> and <a href="https://www.hostnextra.com/vps-hosting.html" target="_blank" rel="noopener">KVM VPS</a>.