/PLAYBOOK · 2026-08-20

Rootkit Detection Hands-On: rkhunter and chkrootkit Config Guide

rkhunter and chkrootkit are the usual Linux rootkit detectors. Principle, install, config, scheduled checks, false-positive handling, and baseline maintenance. Reproducible detection runbook.

Rootkit detection is a key step in Linux server hardening and IR. Once a rootkit is in, the attacker hides backdoors and malicious processes long-term. Conventional AV misses it. This article covers rkhunter and chkrootkit for detection and cleanup, with a copy-paste config.

Use Cases

Suspected compromise: hunt hidden backdoors and privilege-escalation droppers
Periodic security inspection; build a file-attribute baseline
IR: quickly locate kernel-level malicious modules and replaced system binaries

Prerequisites

CentOS 7+ / Ubuntu 18.04+ / Debian 10+
root (tools read system binaries and kernel info)
Working distro repos or EPEL

How It Works

Two classes of rootkit. Userland: LD_PRELOAD hijacks library functions to hide processes and files. Kernel: LKM hooks syscalls for deeper hide. rkhunter compares against a known-rootkit signature DB and a file-attribute baseline (SHA-256). First run builds the baseline; later runs diff against it. chkrootkit inspects running-process binaries and system commands for replacement, and probes common rootkit behaviors. Complementary. Run both.

Procedure

1. Install

`apt-get update && apt-get install -y rkhunter chkrootkit
# CentOS 7:
# yum install -y epel-release
# yum install -y rkhunter chkrootkit`

2. Initialize rkhunter baseline

`rkhunter --propupd`

Required on first run and after OS upgrades. Writes current command hashes to /var/lib/rkhunter/db/rkhunter.dat as the comparison baseline.

3. Key /etc/rkhunter.conf settings

`MIRROR_MODE=1
UPDATE_MIRRORS=1
# False-positive whitelist examples (adjust to your environment):
# ALLOWHIDDENDIR=/etc/.java
# ALLOW_SSHD_ROOTLOGIN_PROTECTED=1`

4. Manual check

`rkhunter --check --sk
chkrootkit -q`

check runs the full scan; sk skips interactive prompts. chkrootkit -q prints only suspected replaced entries.

5. Scheduled inspection

`crontab -e
# Run rkhunter at 03:00 daily and email alerts
0 3 * * * /usr/bin/rkhunter --check --cronjob --report-warnings-only | mail -s "rkhunter daily report" admin@example.com
# Run chkrootkit at 03:30 daily and write logs
30 3 * * * /usr/bin/chkrootkit -q 2>/dev/null > /var/log/chkrootkit.log`

rkhunter --cronjob updates the signature DB then scans. No manual update needed.

Verification

`rkhunter --check --sk`: Rootkits checked has no alerts; overall OK
Inspect `/var/log/rkhunter.log`; Warning count matches expectation (ignore property-baseline warnings)
Detection check: temporarily back up and replace `/bin/ls` with a script; `chkrootkit -q` should flag the command as replaced; restore after
Exit codes: rkhunter returns 1 on findings, 0 if clean

FAQ

FAQ 1: Flood of false positives?

Confirm against process tree and file timestamps whether it is a real intrusion. After confirming FP, whitelist in /etc/rkhunter.conf with ALLOWHIDDENDIR, ALLOW_DEVFILE, etc., or use sk to skip interactive confirms. Do not let FPs bury real alerts.

FAQ 2: More rkhunter alerts after an OS upgrade?

Package updates change command and library hashes. Expected. After confirming the upgrade source is trusted, `rkhunter --propupd` rebuilds the baseline. Do not delete alert logs.

FAQ 3: Signature DB update fails?

Confirm outbound network. Set `UPDATE_MIRRORS=1` and `MIRROR_MODE=1` to enable mirror updates. Air-gapped: download hashlists into /var/lib/rkhunter/db/ then run rkhunter update.

Summary

Do not rely on one tool. Primary: rkhunter baseline + signature checks. Secondary: chkrootkit process-level checks. Cron for continuous inspection. Add AIDE file-integrity monitoring and auditd logs for Linux host defense in depth. On any suspicious alert, isolate the host, preserve the scene, hand to IR.