rkhunter (short for Rootkit Hunter) is an open-source command-line security tool for Unix-like operating systems, primarily Linux, designed to detect rootkits, backdoors, sniffers, and local exploits on a computer system.
Overview
rkhunter performs system scans by comparing current file states against a previously recorded baseline, checking for known signs of malicious software. It is implemented primarily in Perl and Shell and is distributed under the GNU General Public License version 2.0 (GPL v2.0).
History
The project was started in 2003 by Michael Boelen. From 2006 onward, development was continued by the Rootkit Hunter Development Team, led by John Horne and unSpawn. Since December 2023, the project has been sponsored by Dogsbody Technology.
Functionality
rkhunter conducts a range of security checks, including:
- Hash verification: Detecting changes in file hashes, using SHA-256 by default (with support for other algorithms such as MD5, SHA1, SHA384, and SHA512).
- Rootkit file detection: Identifying files that are commonly created by known rootkits.
- Permission anomalies: Flagging executables with unusual or anomalous file permissions.
- Kernel module inspection: Searching for suspicious strings within kernel modules.
- Hidden file detection: Locating hidden files in system directories.
- Optional file content scanning: Optionally scanning inside files for known malicious signatures.
Usage
rkhunter is a command-line utility with several operational modes. Common invocations include:
rkhunter --check— performs a full system check.rkhunter --propupd— updates the file properties database (baseline).rkhunter --update— fetches updates to the database files.rkhunter --list— lists available tests, languages, rootkits, or the file properties database.
Typical configuration is managed through a configuration file (often located at /etc/rkhunter.conf), and results are logged to a log file (commonly /var/log/rkhunter.log).
Limitations
The project's documentation notes that using rkhunter alone does not guarantee that a system is free from compromise. Running complementary tools—such as chkrootkit—is recommended to enhance detection coverage.
Distribution
rkhunter is readily available through the package repositories of many Linux distributions, including Debian/Ubuntu and Kali Linux (where it is packaged at version 1.4.6 as of the relevant release). It can be installed using package managers such as apt (e.g., sudo apt install rkhunter).
Official Resources
- Official website: https://www.rkhunter.dev/
- Source code repository: available on GitHub under the Rootkit-Hunter organization.
