Best Web Hosts 2013 » Articles » Server Security » Rkhunter Installation

Best-Selling Hosting

Top Rated Providers

Editors Pick

Rkhunter Installation Published: Jun 27, 2004

  • Rating

    5/5

Rkhunter is a very useful tool that is used to check for trojans, rootkits, and other security problems.

Rkhunter is a very useful tool that is used to check for trojans, rootkits, and other security problems. This tutorial will touch on installing and setting up a daily report for rkhunter.

Update Aug. 23, 2005

Installing:

wget http://downloads.rootkit.nl/rkhunter-1.2.7.tar.gz
tar -zxvf rkhunter-1.2.7.tar.gz
cd rkhunter-1.2.7
./installer.sh

Now you can run a test scan with the following command:

/usr/local/bin/rkhunter -c

How to setup a daily scan report?

pico /etc/cron.daily/rkhunter.sh

add the following replacing your email address:

#!/bin/bash
(/usr/local/bin/rkhunter -c --cronjob 2>&1 | mail -s "Daily Rkhunter Scan Report" [email protected])

chmod +x /etc/cron.daily/rkhunter.sh

Updating rkhunter
gets the latest database updates from their central server and matches your OS better to prevent false positives.

rkhunter --update

 I just got a false positive!! What do i do?

False positives are warnings which indicates there is a problem, but aren't really a problem. Example: some Linux distro updated a few common used binaries like `ls` and `ps`. You (as a good sysadmin) update the new packages and run (ofcourse) daily Rootkit Hunter. Rootkit Hunter isn't yet aware of these new files and while scanning it resports some "bad" files. In this case we have a false positive. You could always have your datacenter or a system administrator check out the server to verify that it is not compromised.

More information on rkhunter can be found here: http://www.rootkit.nl

  • Rating

    5/5

Related Articles

Comments (15)

  • Gravatar - Chris
    Chris 01:13, August 28, 2004
    You should update this to:<br />
    <br />
    wget http://downloads.rootkit.nl/rkhunter-1.1.6.tar.gz
  • Gravatar - mct
    mct 17:40, December 29, 2004
    make that 1.1.9 as of 12/28/04. :)
  • Gravatar - Amr
    Amr 16:53, March 16, 2005
    wget http://downloads.rootkit.nl/rkhunter-1.2.1.tar.gz<br />
    <br />
    as of 16 March 2005
  • Gravatar - mjm
    mjm 03:45, May 6, 2005
    updated yet again:<br />
    <br />
    wget http://downloads.rootkit.nl/rkhunter-1.2.5.tar.gz<br />
    <br />
    05-05-2005
  • Gravatar - Brad
    Brad 09:44, June 18, 2005
    Make that 1.2.7 as of 6/18/05
  • Gravatar - accyroy
    accyroy 14:57, June 18, 2005
    updated again...<br />
    <br />
    wget http://downloads.rootkit.nl/rkhunter-1.2.7.tar.gz<br />
    <br />
  • Gravatar - BoO_SuLtAn
    BoO_SuLtAn 16:16, June 19, 2005
    The Latest Version Is :<br />
    <br />
    http://downloads.rootkit.nl/rkhunter-1.2.7.tar.gz<br />
    <br />
    Best Regards"
  • Gravatar - Arif Kanji
    Arif Kanji 09:17, August 17, 2005
    Hi,<br />
    How do u make a scan at (for example) 3am everyday.<br />
    Cheers
  • Gravatar - Miguel Costa
    Miguel Costa 00:33, June 4, 2006
    Hy<br />
    <br />
    New version:)<br />
    <br />
    wget http://downloads.rootkit.nl/rkhunter-1.2.8.tar.gz
  • Gravatar - harry
    harry 00:36, August 12, 2006
    Very helpful for level3 issues
  • Gravatar - Chanchal
    Chanchal 02:33, October 2, 2006
    The following binaries to be reported bad while checking Red Hat Linux release 9 (Shrike) servers using rkhunter. Checked 3 servers and confirmed on all.<br />
    <br />
    /bin/dmesg [ BAD ]<br />
    /bin/kill [ BAD ]<br />
    /bin/login [ BAD ]<br />
    /bin/mount [ BAD ]<br />
    <br />
    The package installed is util-linux-2.11y-9.2.legacy
  • Gravatar - Will
    Will 14:24, April 4, 2007
    New version: <br />
    <br />
    wget http://downloads.rootkit.nl/rkhunter-1.2.9.tar.gz
  • Gravatar - Mahdi
    Mahdi 03:47, January 7, 2008
    whats the new version link<br />
    i can not open the downloads.rootkit.nl url :(<br />
    please take te new version download link
  • Gravatar - cdixon311
    cdixon311 00:06, January 13, 2008
    http://superb-east.dl.sourceforge.net/sourceforge/rkhunter/rkhunter-1.3.0.tar.gz<br />
    <br />
    It seems there is a latter version out now.<br />
  • Gravatar - Ritesh
    Ritesh 05:39, March 14, 2008
    Error while running rkhunter<br />
    <br />
    rkhunter-1.3.0<br />
    <br />
    /usr/local/bin/rkhunter -c<br />
    Default logfile will be used (/var/log/rkhunter.log).<br />
    The internationalisation directory does not exist: /var/rkhunter/db/i18n

Add Your Thoughts

WebHostGear.com is a hosting directory, not a web host.

Copyright © 1998-2024 WebHostGear.com