What is rkhunter

Rootkit Hunter, or rkhunter, is an open-source software that scans your server for the presence of rootkits, backdoors, and other security vulnerabilities. It works by comparing the current state of important system files with known good states and identifying suspicious changes or files that could be harmful.

Why Use rkhunter

Installing rkhunter on an Ubuntu VPS

Here is a step-by-step guide to installing rkhunter on an Ubuntu server.

Before installing any new software, it's essential to ensure that your server is up to date:

Now, install rkhunter using the default Ubuntu package manager:

This will download and install rkhunter, along with its dependencies.

After the installation, update rkhunter’s database with the latest known information about rootkits and exploits:

Once the rkhunter database is updated, you should initialize the local file properties database. This allows rkhunter to monitor changes in important system files:

Configuring rkhunter

rkhunter’s configuration file is located at /etc/rkhunter.conf. You can edit this file if you want to customize the behavior of the scans, such as enabling or disabling specific checks.

Open the configuration file using any text editor:

Key options you can modify include:

- MAIL-ON-WARNING: To receive email notifications whenever a scan finds a potential threat, uncomment the line and specify your email address:

- CRON_DAILY_RUN: To enable daily scans via cron, set this value to yes.

Save the file after making your desired changes and exit.

Running rkhunter

To manually run a scan, use the following command:

This will initiate a full scan of your server and check for rootkits, suspicious files, and misconfigurations. During the scan, rkhunter will provide a detailed report of its findings.

If rkhunter detects potential issues, it will display warnings. You can investigate these warnings and take appropriate actions to fix them.

To ensure rkhunter runs automatically on a regular basis, you can set up a cron job. Edit the cron file:

Add the following line to run a daily scan at 2:00 AM:

rkhunter generates logs in /var/log/rkhunter.log. You can review these logs for more detailed information about warnings and alerts:

Warnings might not always indicate a rootkit or security breach. They could be false positives, so make sure to investigate each alert before taking further action.

Updating and Maintaining rkhunter

To keep your rkhunter installation effective, regularly update its database by running:

You should also run a file properties update whenever critical system files change, such as after installing new software:

rkhunter is an invaluable tool for maintaining the security and integrity of your Ubuntu VPS. By regularly scanning for rootkits and malware, and setting up automated scans, you can quickly detect and respond to potential threats. Follow the steps in this guide to install and use rkhunter effectively, ensuring that your VPS remains secure.