What rkhunter does

Rootkit Hunter, or rkhunter, is a free scanner that looks for signs that a Linux server has been compromised at the system level. It checks for:

• Known rootkits, backdoors and local exploits, by looking for their files and folders.
• Changes to important system commands, such as ls, ps and ssh, by comparing them with a baseline of file hashes and permissions.
• Hidden files and folders in system locations.
• Risky settings, such as SSH root logins, and unexpected listening network ports.

rkhunter does not scan websites for malware. For hacked PHP files and uploads, use Linux Malware Detect and ClamAV. The three tools work well together.

Before you start

• ✓ Root access over SSH to a VPS or dedicated server. rkhunter cannot run on shared hosting.
• ✓ A supported Linux release that still gets updates.
• ✓ A working mail setup on the server, if you want email alerts. On cPanel servers, Exim handles this.
• ✓ Ideally, a server you know is clean. The baseline records the current state of the system, good or bad.

Option 1: the one-command helper

The helper script installs rkhunter from your distribution’s packages, sets the alert email, turns on the daily scan, records a baseline and runs a first check. It does not download anything except the rkhunter package.

1. Save the script below as rkhunter-setup.sh on the server, for example in /root.
2. Check the current status. This changes nothing:

sudo bash rkhunter-setup.sh check

3. Install and set up rkhunter, with your email address. The script asks you to type YES first:

sudo bash rkhunter-setup.sh install you@example.com

The helper script

Read the script before you run it.

#!/usr/bin/env bash
# rkhunter-setup.sh
# Installs Rootkit Hunter from your distribution's packages, sets the alert email,
# turns on the daily scan, records a baseline of the system files and runs a first check.
#
# Usage (run as root):
#   sudo bash rkhunter-setup.sh check                      report status. Changes nothing. Default.
#   sudo bash rkhunter-setup.sh install you@example.com    install and set up. Asks for confirmation.

set -u

MODE="${1:-check}"
EMAIL="${2:-root}"

say()  { printf '%s\n' "$*"; }
have() { command -v "$1" >/dev/null 2>&1; }

if [ "$(id -u)" -ne 0 ]; then
  say "Run this script as root (sudo bash rkhunter-setup.sh $MODE)."
  exit 1
fi

if have dnf; then PM="dnf"; PKG="RPM"
elif have yum; then PM="yum"; PKG="RPM"
elif have apt-get; then PM="apt"; PKG="DPKG"
else say "No supported package manager found (dnf, yum or apt-get)."; exit 1
fi

say "== Status =="
if have rkhunter; then
  rkhunter --version | head -n 1
  for LOG in /var/log/rkhunter/rkhunter.log /var/log/rkhunter.log; do
    if [ -f "$LOG" ]; then
      say "Last warnings in $LOG:"
      grep -i 'warning' "$LOG" | tail -n 10
    fi
  done
else
  say "rkhunter is not installed."
fi

[ "$MODE" = "check" ] && exit 0
if [ "$MODE" != "install" ]; then
  say "Unknown mode: $MODE. Use check or install."
  exit 1
fi

say ""
say "This will install rkhunter with $PM, send warnings to $EMAIL, turn on the daily scan,"
say "record a baseline of the current system files and run a first check."
say "Only record a baseline on a server you believe is clean."
printf 'Type YES to continue: '
read -r ANSWER
if [ "$ANSWER" != "YES" ]; then
  say "Stopped. Nothing was changed."
  exit 0
fi

if [ "$PM" = "apt" ]; then
  export DEBIAN_FRONTEND=noninteractive
  apt-get update && apt-get install -y rkhunter
  # Debian and Ubuntu: run the daily scan, update data files, and refresh the baseline after apt upgrades
  if [ -f /etc/default/rkhunter ]; then
    sed -i -e 's/^CRON_DAILY_RUN=.*/CRON_DAILY_RUN="true"/' \
           -e 's/^CRON_DB_UPDATE=.*/CRON_DB_UPDATE="true"/' \
           -e 's/^APT_AUTOGEN=.*/APT_AUTOGEN="true"/' /etc/default/rkhunter
  fi
else
  $PM install -y epel-release >/dev/null 2>&1 || true
  $PM install -y rkhunter
fi

if ! have rkhunter; then
  say "rkhunter was not installed. Check the package manager output above."
  exit 1
fi

# Local settings go in rkhunter.conf.local, so package updates do not overwrite them
CONF_LOCAL=/etc/rkhunter.conf.local
touch "$CONF_LOCAL"
sed -i -e '/^MAIL-ON-WARNING=/d' -e '/^PKGMGR=/d' "$CONF_LOCAL"
printf 'MAIL-ON-WARNING=%s\nPKGMGR=%s\n' "$EMAIL" "$PKG" >> "$CONF_LOCAL"

if ! rkhunter -C; then
  say "The configuration check failed. Review /etc/rkhunter.conf and $CONF_LOCAL."
  exit 1
fi

rkhunter --update || true
rkhunter --propupd
rkhunter --check --sk --rwo || true

say ""
say "Done. The daily scan runs from the package's cron job and emails warnings to $EMAIL."
say "After every system update, run: rkhunter --propupd"

Option 2: install step by step

1. Install the package

# AlmaLinux, Rocky Linux, CloudLinux
dnf install -y epel-release
dnf install -y rkhunter

# Debian and Ubuntu
apt update && apt install -y rkhunter

Use the package, not a tarball from an old guide. Packages are kept up to date and add the daily cron job for you.

2. Set the alert email

Put your own settings in /etc/rkhunter.conf.local, so package updates do not overwrite them:

echo "MAIL-ON-WARNING=you@example.com" >> /etc/rkhunter.conf.local
# Let rkhunter check files against the package database (fewer false warnings)
echo "PKGMGR=RPM" >> /etc/rkhunter.conf.local     # use DPKG on Debian and Ubuntu

# Check the configuration
rkhunter -C

3. Update the data files and record the baseline

rkhunter --update
rkhunter --propupd

--propupd stores the current hashes and permissions of system files. Later scans compare against it.

4. Run a scan

rkhunter --check --sk          # --sk skips the "press Enter" pauses
rkhunter --check --sk --rwo    # show warnings only

5. Turn on the daily scan

On AlmaLinux, Rocky Linux and CloudLinux, the package adds a daily cron job. Set the email address it uses in /etc/sysconfig/rkhunter. On Debian and Ubuntu, edit /etc/default/rkhunter:

CRON_DAILY_RUN="true"
CRON_DB_UPDATE="true"
APT_AUTOGEN="true"     # refresh the baseline after apt upgrades
REPORT_EMAIL="you@example.com"

Read the results

The scan log is in /var/log/rkhunter/rkhunter.log on AlmaLinux and similar systems, or /var/log/rkhunter.log on Debian and Ubuntu. Look for lines marked Warning:

grep -i warning /var/log/rkhunter/rkhunter.log

If rkhunter finds a real problem

1. Do not reboot or delete files straight away. You may lose the evidence of how the attacker got in.
2. Check the warning by hand: look at the file, its owner, its date, and the package it belongs to (rpm -qf or dpkg -S).
3. If you confirm a root-level compromise, the only safe fix is to rebuild the server from a clean install and restore data from backups made before the attack.
4. Change every password and SSH key that was used on the server.
5. Find and fix the way in, for example an outdated site or an unpatched kernel. See our kernel patching guide.

Avoid false warnings

• Run rkhunter --propupd after every system update, or turn on APT_AUTOGEN on Debian and Ubuntu.
• Set PKGMGR so rkhunter checks files against the package database.
• Allow known, legitimate items in /etc/rkhunter.conf.local instead of ignoring warnings.

Troubleshooting