Scanning for Rootkits with rkhunter and chkrootkit

Why Scan?

Rootkits are malicious tools that hide their presence on a compromised system. Regular scanning helps detect compromises that may otherwise go unnoticed.

Install rkhunter

sudo apt install -y rkhunter

# Update database
sudo rkhunter --update
sudo rkhunter --propupd

# Run scan
sudo rkhunter --check --sk

Install chkrootkit

sudo apt install -y chkrootkit

# Run scan
sudo chkrootkit

Understanding Results

Both tools may report false positives. Common false positives:

• /usr/bin/lwp-request — legitimate Perl module
• Hidden directories in /dev — some are normal
• Modified system binaries after updates

Automated Weekly Scans

# /etc/cron.weekly/rootkit-scan
#!/bin/bash
rkhunter --check --sk --report-warnings-only | mail -s "Rootkit Scan: $(hostname)" admin@example.com
chkrootkit | grep -v "not found\|not infected\|nothing found" | mail -s "chkrootkit: $(hostname)" admin@example.com

After a Detection

1. Isolate the server — block all traffic except your SSH
2. Investigate — check running processes, network connections, recent file changes
3. If confirmed — reimage the server from a clean backup
4. Change all credentials and keys