{"id":347,"date":"2016-02-27T17:09:14","date_gmt":"2016-02-27T22:09:14","guid":{"rendered":"http:\/\/underhost.com\/blog\/?p=347"},"modified":"2026-10-23T09:56:33","modified_gmt":"2026-10-23T13:56:33","slug":"how-to-install-rkhunter-on-linux-rootkit-hunter","status":"publish","type":"post","link":"https:\/\/underhost.com\/blog\/how-to-install-rkhunter-on-linux-rootkit-hunter\/","title":{"rendered":"How to Install and Use Rkhunter (Rootkit Hunter) on Linux Servers (2026)"},"content":{"rendered":"<div class=\"uh-blog-hero\" style=\"margin:0 0 40px;text-align:center;padding:48px 24px;border-radius:20px;background:linear-gradient(135deg,#0D1F3C 0%,#125A8A 58%,#176EA5 100%);color:#ffffff;box-shadow:0 20px 40px -15px rgba(13,31,60,0.28);position:relative;overflow:hidden;\">\n<div style=\"display:inline-flex;align-items:center;gap:8px;padding:7px 14px;margin-bottom:16px;border:1px solid rgba(0,212,255,0.32);border-radius:999px;color:#DFF8FF;font-size:12px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;background:rgba(0,212,255,0.10);\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Linux<\/div>\n<h1 style=\"color:#ffffff;font-size:clamp(32px,5vw,46px);line-height:1.12;margin:0 0 14px;font-weight:800;\">How to Install and Use Rkhunter (Rootkit Hunter) on Linux Servers (2026)<\/h1>\n<\/div>\n<div class=\"uh-blog-excerpt\" style=\"border-left:4px solid #00D4FF;padding:18px 20px;margin:0 0 34px;background:#F8FAFC;color:#1F2937;border-radius:0 14px 14px 0;box-shadow:0 8px 28px rgba(13,31,60,0.08);line-height:1.75;\"><strong style=\"color:#0D1F3C;\">Short answer:<\/strong> Install rkhunter from your distribution&#8217;s packages (<code>dnf install rkhunter<\/code> from EPEL on AlmaLinux, Rocky Linux and CloudLinux, or <code>apt install rkhunter<\/code> on Debian and Ubuntu). Then update its data files with <code>rkhunter --update<\/code>, record a baseline of your system files with <code>rkhunter --propupd<\/code>, and scan with <code>rkhunter --check --sk<\/code>. Set an email address for warnings and let the daily cron job run. Run <code>--propupd<\/code> again after every system update, or you will get false warnings.<\/div>\n<nav aria-label=\"Table of contents\" class=\"uh-toc\" style=\"background:#ffffff;border:1px solid #E5E7EB;border-radius:16px;padding:20px 22px;margin:0 0 34px;box-shadow:0 4px 12px rgba(13,31,60,0.08);\">\n<div style=\"font-size:12px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;color:#176EA5;margin-bottom:10px;\"><i class=\"fas fa-list\" style=\"color:#00D4FF;\"><\/i> In this guide<\/div>\n<ol style=\"margin:0;padding-left:20px;columns:2 260px;column-gap:28px;line-height:1.9;\">\n<li><a href=\"#what-rkhunter-does\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">What rkhunter does<\/a><\/li>\n<li><a href=\"#before-you-start\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Before you start<\/a><\/li>\n<li><a href=\"#option-1-the-one-command-helper\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Option 1: the one-command helper<\/a><\/li>\n<li><a href=\"#option-2-install-step-by-step\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Option 2: install step by step<\/a><\/li>\n<li><a href=\"#read-the-results\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Read the results<\/a><\/li>\n<li><a href=\"#if-rkhunter-finds-a-real-problem\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">If rkhunter finds a real problem<\/a><\/li>\n<li><a href=\"#avoid-false-warnings\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Avoid false warnings<\/a><\/li>\n<li><a href=\"#troubleshooting\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Troubleshooting<\/a><\/li>\n<\/ol>\n<\/nav>\n<div class=\"uh-post-content\" style=\"color:#1F2937;font-size:16px;line-height:1.75;\">\n<h2 id=\"what-rkhunter-does\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-info-circle\" style=\"color:#00D4FF;\"><\/i> What rkhunter does<\/h2>\n<p style=\"margin:0 0 18px;\">Rootkit Hunter, or rkhunter, is a free scanner that looks for signs that a Linux server has been compromised at the system level. It checks for:<\/p>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Known rootkits, backdoors and local exploits, by looking for their files and folders.<\/li>\n<li style=\"margin:0 0 8px;\">Changes to important system commands, such as <code>ls<\/code>, <code>ps<\/code> and <code>ssh<\/code>, by comparing them with a baseline of file hashes and permissions.<\/li>\n<li style=\"margin:0 0 8px;\">Hidden files and folders in system locations.<\/li>\n<li style=\"margin:0 0 8px;\">Risky settings, such as SSH root logins, and unexpected listening network ports.<\/li>\n<\/ul>\n<p style=\"margin:0 0 18px;\">rkhunter does not scan websites for malware. For hacked PHP files and uploads, use <a href=\"https:\/\/underhost.com\/blog\/how-to-install-linux-malware-detect\/\">Linux Malware Detect<\/a> and <a href=\"https:\/\/underhost.com\/blog\/how-to-install-clamav-cpanel\/\">ClamAV<\/a>. The three tools work well together.<\/p>\n<h2 id=\"before-you-start\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-clipboard-check\" style=\"color:#00D4FF;\"><\/i> Before you start<\/h2>\n<ul style=\"list-style:none;padding-left:0;\">\n<li style=\"margin:0 0 8px;\">\u2713 Root access over SSH to a VPS or dedicated server. rkhunter cannot run on shared hosting.<\/li>\n<li style=\"margin:0 0 8px;\">\u2713 A supported Linux release that still gets updates.<\/li>\n<li style=\"margin:0 0 8px;\">\u2713 A working mail setup on the server, if you want email alerts. On cPanel servers, Exim handles this.<\/li>\n<li style=\"margin:0 0 8px;\">\u2713 Ideally, a server you know is clean. The baseline records the current state of the system, good or bad.<\/li>\n<\/ul>\n<h2 id=\"option-1-the-one-command-helper\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Option 1: the one-command helper<\/h2>\n<p style=\"margin:0 0 18px;\">The helper script installs rkhunter from your distribution&#8217;s packages, sets the alert email, turns on the daily scan, records a baseline and runs a first check. It does not download anything except the rkhunter package.<\/p>\n<ol style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Save the script below as <code>rkhunter-setup.sh<\/code> on the server, for example in <code>\/root<\/code>.<\/li>\n<li style=\"margin:0 0 8px;\">Check the current status. This changes nothing:<\/li>\n<\/ol>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>sudo bash rkhunter-setup.sh check<\/code><\/pre>\n<ol start=\"3\" style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Install and set up rkhunter, with your email address. The script asks you to type YES first:<\/li>\n<\/ol>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>sudo bash rkhunter-setup.sh install you@example.com<\/code><\/pre>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">The helper script<\/h3>\n<p style=\"margin:0 0 18px;\">Read the script before you run it.<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>#!\/usr\/bin\/env bash\n# rkhunter-setup.sh\n# Installs Rootkit Hunter from your distribution's packages, sets the alert email,\n# turns on the daily scan, records a baseline of the system files and runs a first check.\n#\n# Usage (run as root):\n#   sudo bash rkhunter-setup.sh check                      report status. Changes nothing. Default.\n#   sudo bash rkhunter-setup.sh install you@example.com    install and set up. Asks for confirmation.\n\nset -u\n\nMODE=\"${1:-check}\"\nEMAIL=\"${2:-root}\"\n\nsay()  { printf '%s\\n' \"$*\"; }\nhave() { command -v \"$1\" &gt;\/dev\/null 2&gt;&amp;1; }\n\nif [ \"$(id -u)\" -ne 0 ]; then\n  say \"Run this script as root (sudo bash rkhunter-setup.sh $MODE).\"\n  exit 1\nfi\n\nif have dnf; then PM=\"dnf\"; PKG=\"RPM\"\nelif have yum; then PM=\"yum\"; PKG=\"RPM\"\nelif have apt-get; then PM=\"apt\"; PKG=\"DPKG\"\nelse say \"No supported package manager found (dnf, yum or apt-get).\"; exit 1\nfi\n\nsay \"== Status ==\"\nif have rkhunter; then\n  rkhunter --version | head -n 1\n  for LOG in \/var\/log\/rkhunter\/rkhunter.log \/var\/log\/rkhunter.log; do\n    if [ -f \"$LOG\" ]; then\n      say \"Last warnings in $LOG:\"\n      grep -i 'warning' \"$LOG\" | tail -n 10\n    fi\n  done\nelse\n  say \"rkhunter is not installed.\"\nfi\n\n[ \"$MODE\" = \"check\" ] &amp;&amp; exit 0\nif [ \"$MODE\" != \"install\" ]; then\n  say \"Unknown mode: $MODE. Use check or install.\"\n  exit 1\nfi\n\nsay \"\"\nsay \"This will install rkhunter with $PM, send warnings to $EMAIL, turn on the daily scan,\"\nsay \"record a baseline of the current system files and run a first check.\"\nsay \"Only record a baseline on a server you believe is clean.\"\nprintf 'Type YES to continue: '\nread -r ANSWER\nif [ \"$ANSWER\" != \"YES\" ]; then\n  say \"Stopped. Nothing was changed.\"\n  exit 0\nfi\n\nif [ \"$PM\" = \"apt\" ]; then\n  export DEBIAN_FRONTEND=noninteractive\n  apt-get update &amp;&amp; apt-get install -y rkhunter\n  # Debian and Ubuntu: run the daily scan, update data files, and refresh the baseline after apt upgrades\n  if [ -f \/etc\/default\/rkhunter ]; then\n    sed -i -e 's\/^CRON_DAILY_RUN=.*\/CRON_DAILY_RUN=\"true\"\/' \\\n           -e 's\/^CRON_DB_UPDATE=.*\/CRON_DB_UPDATE=\"true\"\/' \\\n           -e 's\/^APT_AUTOGEN=.*\/APT_AUTOGEN=\"true\"\/' \/etc\/default\/rkhunter\n  fi\nelse\n  $PM install -y epel-release &gt;\/dev\/null 2&gt;&amp;1 || true\n  $PM install -y rkhunter\nfi\n\nif ! have rkhunter; then\n  say \"rkhunter was not installed. Check the package manager output above.\"\n  exit 1\nfi\n\n# Local settings go in rkhunter.conf.local, so package updates do not overwrite them\nCONF_LOCAL=\/etc\/rkhunter.conf.local\ntouch \"$CONF_LOCAL\"\nsed -i -e '\/^MAIL-ON-WARNING=\/d' -e '\/^PKGMGR=\/d' \"$CONF_LOCAL\"\nprintf 'MAIL-ON-WARNING=%s\\nPKGMGR=%s\\n' \"$EMAIL\" \"$PKG\" &gt;&gt; \"$CONF_LOCAL\"\n\nif ! rkhunter -C; then\n  say \"The configuration check failed. Review \/etc\/rkhunter.conf and $CONF_LOCAL.\"\n  exit 1\nfi\n\nrkhunter --update || true\nrkhunter --propupd\nrkhunter --check --sk --rwo || true\n\nsay \"\"\nsay \"Done. The daily scan runs from the package's cron job and emails warnings to $EMAIL.\"\nsay \"After every system update, run: rkhunter --propupd\"<\/code><\/pre>\n<h2 id=\"option-2-install-step-by-step\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Option 2: install step by step<\/h2>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">1. Install the package<\/h3>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code># AlmaLinux, Rocky Linux, CloudLinux\ndnf install -y epel-release\ndnf install -y rkhunter\n\n# Debian and Ubuntu\napt update &amp;&amp; apt install -y rkhunter<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">Use the package, not a tarball from an old guide. Packages are kept up to date and add the daily cron job for you.<\/p>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">2. Set the alert email<\/h3>\n<p style=\"margin:0 0 18px;\">Put your own settings in <code>\/etc\/rkhunter.conf.local<\/code>, so package updates do not overwrite them:<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>echo \"MAIL-ON-WARNING=you@example.com\" &gt;&gt; \/etc\/rkhunter.conf.local\n# Let rkhunter check files against the package database (fewer false warnings)\necho \"PKGMGR=RPM\" &gt;&gt; \/etc\/rkhunter.conf.local     # use DPKG on Debian and Ubuntu\n\n# Check the configuration\nrkhunter -C<\/code><\/pre>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">3. Update the data files and record the baseline<\/h3>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>rkhunter --update\nrkhunter --propupd<\/code><\/pre>\n<p style=\"margin:0 0 18px;\"><code>--propupd<\/code> stores the current hashes and permissions of system files. Later scans compare against it.<\/p>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">4. Run a scan<\/h3>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>rkhunter --check --sk          # --sk skips the \"press Enter\" pauses\nrkhunter --check --sk --rwo    # show warnings only<\/code><\/pre>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">5. Turn on the daily scan<\/h3>\n<p style=\"margin:0 0 18px;\">On AlmaLinux, Rocky Linux and CloudLinux, the package adds a daily cron job. Set the email address it uses in <code>\/etc\/sysconfig\/rkhunter<\/code>. On Debian and Ubuntu, edit <code>\/etc\/default\/rkhunter<\/code>:<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>CRON_DAILY_RUN=\"true\"\nCRON_DB_UPDATE=\"true\"\nAPT_AUTOGEN=\"true\"     # refresh the baseline after apt upgrades\nREPORT_EMAIL=\"you@example.com\"<\/code><\/pre>\n<h2 id=\"read-the-results\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-angle-double-right\" style=\"color:#00D4FF;\"><\/i> Read the results<\/h2>\n<p style=\"margin:0 0 18px;\">The scan log is in <code>\/var\/log\/rkhunter\/rkhunter.log<\/code> on AlmaLinux and similar systems, or <code>\/var\/log\/rkhunter.log<\/code> on Debian and Ubuntu. Look for lines marked <strong>Warning<\/strong>:<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>grep -i warning \/var\/log\/rkhunter\/rkhunter.log<\/code><\/pre>\n<div style=\"overflow-x:auto;margin:26px 0;border:1px solid #E5E7EB;border-radius:14px;-webkit-overflow-scrolling:touch;\">\n<table style=\"width:100%;border-collapse:collapse;background:#ffffff;color:#1F2937;font-size:15px;line-height:1.55;margin:0;min-width:600px;\">\n<thead>\n<tr style=\"background:#0D1F3C;color:#fff;\">\n<th style=\"padding:14px;text-align:left;\">Warning<\/th>\n<th style=\"padding:14px;text-align:left;\">What it usually means<\/th>\n<th style=\"padding:14px;text-align:left;\">What to do<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">File properties have changed<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">A system update changed the file, or the file was replaced<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">If you just updated the system, run <code>rkhunter --propupd<\/code>. If not, investigate.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Hidden file or directory found<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Some packages keep hidden files in \/dev or \/etc<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Check what owns the file. If it is legitimate, allow it with ALLOWHIDDENFILE or ALLOWHIDDENDIR.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">SSH root access allowed<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">PermitRootLogin is enabled<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Use key-based logins and disable root password logins, or allow it in the config if you accept the risk.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Possible rootkit found<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Files that match a known rootkit<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Treat this as serious. Do not ignore it. See the next section.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h2 id=\"if-rkhunter-finds-a-real-problem\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-exclamation-triangle\" style=\"color:#00D4FF;\"><\/i> If rkhunter finds a real problem<\/h2>\n<ol style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Do not reboot or delete files straight away. You may lose the evidence of how the attacker got in.<\/li>\n<li style=\"margin:0 0 8px;\">Check the warning by hand: look at the file, its owner, its date, and the package it belongs to (<code>rpm -qf<\/code> or <code>dpkg -S<\/code>).<\/li>\n<li style=\"margin:0 0 8px;\">If you confirm a root-level compromise, the only safe fix is to rebuild the server from a clean install and restore data from backups made before the attack.<\/li>\n<li style=\"margin:0 0 8px;\">Change every password and SSH key that was used on the server.<\/li>\n<li style=\"margin:0 0 8px;\">Find and fix the way in, for example an outdated site or an unpatched kernel. See our <a href=\"https:\/\/underhost.com\/blog\/patch-protect-vulnerability-dirty-cow\/\">kernel patching guide<\/a>.<\/li>\n<\/ol>\n<h2 id=\"avoid-false-warnings\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-exclamation-triangle\" style=\"color:#00D4FF;\"><\/i> Avoid false warnings<\/h2>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Run <code>rkhunter --propupd<\/code> after every system update, or turn on APT_AUTOGEN on Debian and Ubuntu.<\/li>\n<li style=\"margin:0 0 8px;\">Set <code>PKGMGR<\/code> so rkhunter checks files against the package database.<\/li>\n<li style=\"margin:0 0 8px;\">Allow known, legitimate items in <code>\/etc\/rkhunter.conf.local<\/code> instead of ignoring warnings.<\/li>\n<\/ul>\n<h2 id=\"troubleshooting\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-exclamation-triangle\" style=\"color:#00D4FF;\"><\/i> Troubleshooting<\/h2>\n<div style=\"overflow-x:auto;margin:26px 0;border:1px solid #E5E7EB;border-radius:14px;-webkit-overflow-scrolling:touch;\">\n<table style=\"width:100%;border-collapse:collapse;background:#ffffff;color:#1F2937;font-size:15px;line-height:1.55;margin:0;min-width:600px;\">\n<thead>\n<tr style=\"background:#0D1F3C;color:#fff;\">\n<th style=\"padding:14px;text-align:left;\">Problem<\/th>\n<th style=\"padding:14px;text-align:left;\">Likely cause<\/th>\n<th style=\"padding:14px;text-align:left;\">Fix<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\"><code>rkhunter --update<\/code> fails on Ubuntu with an invalid WEB_CMD error<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">The packaged configuration disables downloads<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Set <code>WEB_CMD=\"\"<\/code> in \/etc\/rkhunter.conf, or rely on package updates for the data files.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">No email alerts arrive<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">The server cannot send mail, or the address is wrong<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Test with <code>echo test | mail -s test you@example.com<\/code> and check MAIL-ON-WARNING.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Many warnings after an update<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">The baseline is out of date<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Confirm the update was yours, then run <code>rkhunter --propupd<\/code>.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<div aria-hidden=\"true\" class=\"uh-section-divider\" style=\"width:min(100% - 32px, 1080px);margin:44px auto;display:grid;grid-template-columns:1fr 32px 1fr;align-items:center;gap:18px;pointer-events:none;\"><span style=\"height:1px;background:linear-gradient(90deg,transparent,rgba(0,212,255,0.40),rgba(23,110,165,0.24),transparent);\"><\/span><img alt=\"\" decoding=\"async\" height=\"32\" loading=\"lazy\" src=\"https:\/\/cdn.underhost.com\/android-chrome-192x192.webp\" style=\"width:32px;height:32px;display:block;border-radius:8px;filter:drop-shadow(0 0 14px rgba(0,212,255,0.30));\" width=\"32\"\/><span style=\"height:1px;background:linear-gradient(90deg,transparent,rgba(23,110,165,0.24),rgba(0,212,255,0.40),transparent);\"><\/span><\/div>\n<\/div>\n<div class=\"uh-blog-cta\" style=\"background:linear-gradient(135deg,#0D1F3C 0%,#125A8A 58%,#176EA5 100%);color:#ffffff;padding:36px 24px;border-radius:20px;text-align:center;margin:44px 0;box-shadow:0 20px 40px -15px rgba(13,31,60,0.32);\">\n<h2 style=\"margin:0 0 12px;font-size:28px;line-height:1.25;color:#ffffff;\">Need help with this?<\/h2>\n<p style=\"font-size:17px;margin:0 auto 22px;color:#EAF6FF;max-width:720px;line-height:1.7;\">Would you rather have experts watch your server? Our server management team monitors, patches and secures it for you.<\/p>\n<p><a href=\"https:\/\/underhost.com\/server-management.php\" style=\"background:linear-gradient(90deg,#00D4FF,#0077FF);color:#ffffff;padding:13px 28px;border-radius:10px;text-decoration:none;font-weight:800;display:inline-block;margin:8px;\">See server management plans<\/a><a href=\"https:\/\/customerpanel.ca\/client\/\" style=\"background:transparent;color:#ffffff;padding:12px 28px;border-radius:10px;text-decoration:none;font-weight:800;display:inline-block;margin:8px;border:1px solid rgba(255,255,255,0.32);\">Contact @CustomerPanel<\/a><\/div>\n<div class=\"uh-faq-section\" id=\"faq\" style=\"margin:34px 0;scroll-margin-top:90px;\">\n<h2 style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:0 0 18px;border-bottom:2px solid rgba(0,212,255,0.22);padding-bottom:10px;\">Frequently asked questions<\/h2>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Is rkhunter still useful in 2026?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Yes, as one layer. Its rootkit signatures are old, but its checks for changed system files, hidden files and risky settings still catch real problems. Use it with malware scanners and regular updates.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Does rkhunter remove malware?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">No. rkhunter only reports. If it finds a confirmed rootkit, rebuild the server from a clean install.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Can I run rkhunter on shared hosting?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">No. It needs root access. On shared hosting, your host scans the server.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Why does rkhunter warn after every update?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Updates change system files, so they no longer match the baseline. Run rkhunter &#8211;propupd after each update.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Should I use rkhunter or chkrootkit?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Both look for rootkits in different ways. Many administrators run both, together with a website malware scanner.<\/p>\n<\/div>\n<\/div>\n<p><!-- uh-related-start --><\/p>\n<div style=\"background:#F4F8FC;border:1px solid #DCE7F3;border-radius:14px;padding:18px 22px;margin:32px 0 8px;\">\n<h2 style=\"margin:0 0 12px;font-size:22px;\">Related guides<\/h2>\n<ul style=\"margin:0;padding-left:20px;\">\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/install-ffmpeg-on-linux\/\">Install FFmpeg on AlmaLinux, Debian, CentOS, and Ubuntu (Updated Guide)<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/install-varnish-centos-7\/\">How to Install Varnish on CentOS 7<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/how-to-install-linux-malware-detect\/\">How to Install Linux Malware Detect (LMD)<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/cve-2026-31431-copy-fail-linux-server-patch-guide\/\">CVE-2026-31431 \u2018Copy Fail\u2019: Why Linux Server Owners Should Patch Now<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/centos-7-cloudlinux-7-eol-what-underhost-customers-need-to-know-before-july-1-2025\/\">CentOS 7 &amp; CloudLinux 7 EOL: What UnderHost Customers Need to Know Before July 1, 2025<\/a><\/li>\n<\/ul>\n<\/div>\n<p><!-- uh-related-end --><br \/>\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Is rkhunter still useful in 2026?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Yes, as one layer. Its rootkit signatures are old, but its checks for changed system files, hidden files and risky settings still catch real problems. Use it with malware scanners and regular updates.\"}}, {\"@type\": \"Question\", \"name\": \"Does rkhunter remove malware?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. rkhunter only reports. If it finds a confirmed rootkit, rebuild the server from a clean install.\"}}, {\"@type\": \"Question\", \"name\": \"Can I run rkhunter on shared hosting?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. It needs root access. On shared hosting, your host scans the server.\"}}, {\"@type\": \"Question\", \"name\": \"Why does rkhunter warn after every update?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Updates change system files, so they no longer match the baseline. Run rkhunter --propupd after each update.\"}}, {\"@type\": \"Question\", \"name\": \"Should I use rkhunter or chkrootkit?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Both look for rootkits in different ways. Many administrators run both, together with a website malware scanner.\"}}]}<\/script><\/p>\n<h2 id=\"sources\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-book\" style=\"color:#00D4FF;\"><\/i> Sources<\/h2>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/rkhunter.sourceforge.net\/\">Rootkit Hunter project page<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/manpages.ubuntu.com\/manpages\/noble\/man8\/rkhunter.8.html\">Ubuntu manual page: rkhunter<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/docs.fedoraproject.org\/en-US\/epel\/\">Fedora EPEL<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Install rkhunter from your distribution&#8217;s packages (dnf install rkhunter from EPEL on AlmaLinux, Rocky Linux and CloudLinux, or apt install rkhunter on Debian and Ubuntu). Then update its data files with rkhunter &#8211;update, record a baseline of your system files with rkhunter &#8211;propupd, and scan with rkhunter &#8211;check &#8211;sk. Set an email address for warnings and let the daily cron job run. Run &#8211;propupd again after every system update, or you will get false warnings.<\/p>\n","protected":false},"author":1,"featured_media":311,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25,203],"tags":[111,112,113,115,127,114],"class_list":["post-347","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","category-security","tag-tag-almalinux","tag-tag-centos","tag-tag-debian","tag-tag-linux-server","tag-tag-malware-protection","tag-tag-ubuntu"],"_links":{"self":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/347","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/comments?post=347"}],"version-history":[{"count":8,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/347\/revisions"}],"predecessor-version":[{"id":7023,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/347\/revisions\/7023"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media\/311"}],"wp:attachment":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media?parent=347"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/categories?post=347"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/tags?post=347"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}