Installing Rkhunter (Rootkit Hunter) in RHEL, CentOS and Fedora
Rkhunter (Rootkit Hunter) is an open source Unix/Linux based scanner tool for Linux systems released under GPL that scans backdoors, rootkits and local exploits on your systems. It scans hidden files, wrong permissions set on binaries, suspicious strings in kernel etc. To know more about Rkhunter and its features visit http://www.rootkit.nl/.
Step 1: Downloading Rkhunter
First download the latest stable version of Rkhunter tool by going tohttp://www.rootkit.nl/projects/rootkit_hunter.html or use below Wget command to download it on your systems.# cd /tmp # wget http://ncu.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.0/rkhunter-1.4.0.tar.gz
Step 2: Installing Rkhunter
Once you have downloaded the latest version, run the following commands as a root user to install it.# tar -xvf rkhunter-1.4.0.tar.gz # cd rkhunter-1.4.0 # ./installer.sh --layout default --install
Step 3: Updating Rkhunter
Run the RKH updater to fill the database properties by running the following command.# /usr/local/bin/rkhunter --update # /usr/local/bin/rkhunter --propupd
Step 4: Setting Cronjob and Email Alerts
Create a file called rkhunter.sh under /etc/cron.daily/, which then scans your file system every day and sends email notifications to your email id. Create following file with the help of your favourite editor.# vi /etc/cron.daily/rkhunter.sh
Add the following lines of code to it and replace “YourServerNameHere” with your “Server Name” and “[email protected]” with your “Email Id“.#!/bin/sh ( /usr/local/bin/rkhunter --versioncheck /usr/local/bin/rkhunter --update /usr/local/bin/rkhunter --cronjob --report-warnings-only ) | /bin/mail -s 'rkhunter Daily Run (PutYourServerNameHere)' [email protected]
Set execute permission on the file.# chmod 755 /etc/cron.daily/rkhunter.sh
Step 5: Manual Scan and Usage
To scan the entire file system, run the Rkhunter as a root user.# rkhunter --check
The above command generates log file under /var/log/rkhunter.log with the checks results made by Rkhunter. For more information and options please run the following command.# rkhunter --help
Was this answer helpful?
Everyone knows 22 is the default SSH port. So it’s always good to change this default port...
ad Impact of Symlink - Suppose you own a small hosting company with a Linux Box, & 1337...
This tutorial will teach you how to use the IP Deny Manager to block access to your web site from...
Suspect there are other users in your system that have shell access to your system? Please follow...
Login to WHM using root username/passwdhttp://serverip:2086 or http://serverip/whm WHM –...