Installing Rkhunter on your Linux server helps enhance system security by providing regular scans and alerts for any unauthorized changes or malicious activities. It is widely used by system administrators as part of a proactive security monitoring strategy.<\/p>\n\n\n\n
<\/p>\n\n\n\n Before installing Rkhunter, ensure the following requirements are met:<\/p>\n\n\n\n Let\u2019s move the current directory to the temp directory. Unzip the downloaded rkhunter by using the below command. To check the rkhunter current version. To scan the entire file system run. Sample Output: Setting Cronjob and Email Alerts: Change the permission of the file to 755. For more information and options please run the following command Configuration file of rkhunter is \/etc\/rkhunter.conf <\/strong>. We can modify the properties of rkhunter accordingly to secure the server.<\/p>\n\n\n\n To restrict the root login to the server over SSH To allow the root login to the server over SSH Installing Rkhunter on a Linux server is a simple yet effective step toward strengthening system security. By regularly scanning for rootkits and suspicious activities, it helps administrators detect potential threats early and take corrective actions.<\/p>\n\n\n\n While Rkhunter is not a complete security solution on its own, it serves as a valuable addition to your overall security strategy when combined with firewalls, intrusion detection systems, and regular system updates. Keeping Rkhunter updated and running scheduled scans ensures continuous monitoring and improved protection of your server environment.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n","protected":false},"excerpt":{"rendered":" Introduction Rkhunter (Rootkit Hunter) is an open-source security tool used to scan Linux systems for rootkits, backdoors, and other potential security threats. It works by comparing file hashes, checking for suspicious strings in kernel modules, and verifying system binaries against known good values. Installing Rkhunter on your Linux server helps enhance system security by providing ..<\/p>\n![\"\"](\"https:\/\/pheonixsolutions.com\/knowledge-base\/wp-content\/uploads\/2020\/04\/images.png\")
<\/figure>\n\n\n\nPre-requisites<\/h2>\n\n\n\n
\n
<\/li>\n<\/ul>\n\n\n\nIMPLEMENTATION<\/h2>\n\n\n\n
Step 1: Downloading Rkhunter:<\/h4>\n\n\n\n
# cd \/tmp
Download the latest version of Rkhunter by executing the command below.
#wget http:\/\/downloads.sourceforge.net\/project\/rkhunter\/rkhunter\/1.4.2\/rkhunter-1.4.2.tar.gz<\/p>\n\n\n\nStep 2: Installing Rkhunter:<\/h4>\n\n\n\n
#tar -zxvf rkhunter-1.4.2.tar.gz
Change the current working directory to the rkhunter directory.
#cd rkhunter-1.4.2
Install the rkhunter package by executing the installation script.
#.\/installer.sh –layout default –install<\/p>\n\n\n\nStep 3: Updating Rkhunter:<\/h4>\n\n\n\n
#\/usr\/local\/bin\/rkhunter –versioncheck
To update the rkhunter available latest version.
#\/usr\/local\/bin\/rkhunter –update
If the database files are updated, to check and save the updated values and properties,
#\/usr\/local\/bin\/rkhunter –propupd<\/p>\n\n\n\nStep 4: Manual Scan and Usage:<\/h4>\n\n\n\n
# rkhunter –check<\/p>\n\n\n\n
<\/p>\n\n\n\n[ Rootkit Hunter version 1.4.2 ]\n\nChecking system commands...\n\n Performing 'strings' command checks\n Checking 'strings' command [ OK ]\n\n Performing 'shared libraries' checks\n Checking for preloading variables [ None found ]\n Checking for preloaded libraries [ None found ]\n Checking LD_LIBRARY_PATH variable [ Not found ]\n\n Performing file properties checks\n Checking for prerequisites [ OK ]\n \/usr\/local\/bin\/rkhunter [ OK ]\n \/usr\/sbin\/adduser [ OK ]\n \/usr\/sbin\/chkconfig [ OK ]\n \/usr\/sbin\/chroot [ OK ]\n \/usr\/sbin\/depmod [ OK ]\n \/usr\/sbin\/fsck [ OK ]\n \/usr\/sbin\/fuser [ OK ]\n \/usr\/sbin\/groupadd [ OK ]\n \/usr\/sbin\/groupdel [ OK ]\n \/usr\/sbin\/groupmod [ OK ]\n \/usr\/sbin\/grpck [ OK ]\n \/usr\/sbin\/ifconfig [ OK ]\n \/usr\/sbin\/ifdown [ Warning ]\n \/usr\/sbin\/ifup [ Warning ]\n \/usr\/sbin\/init [ OK ]\n \/usr\/sbin\/insmod [ OK ]\n \/usr\/sbin\/ip [ OK ]\n \/usr\/sbin\/lsmod [ OK ]\n \/usr\/sbin\/lsof [ OK ]\n \/usr\/sbin\/modinfo [ OK ]\n \/usr\/sbin\/modprobe [ OK ]\n \/usr\/sbin\/nologin [ OK ]\n \/usr\/sbin\/pwck [ OK ]\n \/usr\/sbin\/rmmod [ OK ]\n \/usr\/sbin\/route [ OK ]\n \/usr\/sbin\/rsyslogd [ OK ]\n \/usr\/sbin\/runlevel [ OK ]\n \/usr\/sbin\/sestatus [ OK ]\n \/usr\/sbin\/sshd [ OK ]\n \/usr\/sbin\/sulogin [ OK ]\n \/usr\/sbin\/sysctl [ OK ]\n \/usr\/sbin\/tcpd [ OK ]\n \/usr\/sbin\/useradd [ OK ]\n \/usr\/sbin\/userdel [ OK ]\n \/usr\/sbin\/usermod [ OK ]\n....\n[Press to continue]\n\n\nChecking for rootkits...\n\n Performing check of known rootkit files and directories\n 55808 Trojan - Variant A [ Not found ]\n ADM Worm [ Not found ]\n AjaKit Rootkit [ Not found ]\n Adore Rootkit [ Not found ]\n aPa Kit [ Not found ]\n.....\n\n[Press to continue]\n\n\n Performing additional rootkit checks\n Suckit Rookit additional checks [ OK ]\n Checking for possible rootkit files and directories [ None found ]\n Checking for possible rootkit strings [ None found ]\n\n....\n[Press to continue]\n\n\nChecking the network...\n\n Performing checks on the network ports\n Checking for backdoor ports [ None found ]\n....\n Performing system configuration file checks\n Checking for an SSH configuration file [ Found ]\n Checking if SSH root access is allowed [ Warning ]\n Checking if SSH protocol v1 is allowed [ Warning ]\n Checking for a running system logging daemon [ Found ]\n Checking for a system logging configuration file [ Found ]\n Checking if syslog remote logging is allowed [ Not allowed ]\n...\nSystem checks summary\n=====================\n\nFile properties checks...\n Files checked: 137\n Suspect files: 6\n\nRootkit checks...\n Rootkits checked : 383\n Possible rootkits: 0\n\nApplications checks...\n Applications checked: 5\n Suspect applications: 2\n\nThe system checks took: 5 minutes and 38 seconds\n\nAll results have been written to the log file: \/var\/log\/rkhunter.log\n\nOne or more warnings have been found while checking the system.\nPlease check the log file (\/var\/log\/rkhunter.log)<\/pre>\n\n\n\n
Step 5: Scheduling Automatic Scans<\/strong>:<\/h4>\n\n\n\n
Create a file called rkhunter.sh<\/strong> under \/etc\/cron.daily\/<\/strong>, which then scans your file system every day and sends email notifications to your email id.
Open the file to write the script.
# vi \/etc\/cron.daily\/rkhunter.sh
Paste the below-given script in this file and replace \u201cServer name<\/strong>\u201d with your \u201cServer Host Name\u201d<\/strong> and \u201cmail id<\/strong>\u201d with your \u201cEmail Id<\/strong>\u201c.
<\/p>\n\n\n\n#!\/bin\/sh\n(\n\/usr\/local\/bin\/rkhunter --versioncheck\n\/usr\/local\/bin\/rkhunter --update\n\/usr\/local\/bin\/rkhunter --cronjob --report-warnings-only\n) | \/bin\/mail -s 'rkhunter Daily Run (Server name)' mail id<\/strong><\/pre>\n\n\n\n
# chmod 755 \/etc\/cron.daily\/rkhunter.sh<\/p>\n\n\n\n
# rkhunter –help<\/p>\n\n\n\nStep 6: Configuration Of Rkhunter<\/strong><\/h4>\n\n\n\n
ALLOW_SSH_ROOT_USER = no<\/p>\n\n\n\n
ALLOW_SSH_ROOT_USER = yes<\/p>\n\n\n\nConclusion:<\/h4>\n\n\n\n
<\/p>\n\n\n\n
<\/p>\n\n\n\n