>

Scan for Rootkits with rkhunter

Run a full rootkit, backdoor, and local-exploit scan from the terminal and review the pass/warning summary and log.

LinuxrootkitrkhunterclisecurityMedium risk
Run sudo rkhunter --update && sudo rkhunter --check --sk to update signatures and scan the system non-interactively.

01Command

Command
$ sudo rkhunter --update && sudo rkhunter --check --sk

02What it does

Rootkit Hunter checks for known rootkit signatures, compares system binaries against known-good hashes, and looks for suspicious hidden files and kernel modules — behaviors typical of a compromised machine. --sk suppresses the 'press Enter' pauses so the scan runs unattended, and the summary at the end lists every warning. Warnings are not proof of compromise: package-managed configs and binaries often trip tests, so read /var/log/rkhunter.log and confirm anything serious against your package manager before acting.

03Risk

RiskMedium risk
Requirementsrkhunter (sudo apt install rkhunter / sudo dnf install rkhunter)
!Warning: Don't panic-delete files flagged by rkhunter — many hits are false positives from distro-specific configurations; investigate each warning in the log first.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • rkhunter — Debian Wiki
    Debian · community · 2026-09-17
    Evidence: Debian's guidance on configuring rkhunter, expected false positives on packaged systems, and log file location (/var/log/rkhunter.log).
  • rkhunter(8) — Linux manual page
    Arch Linux · community · 2026-09-17
    Evidence: rkhunter --check scans for rootkits, backdoors and local exploits; --update refreshes detection data; --sk skips keypresses between tests.

Last verified: 2026-09-18 · Category: Security & Privacy

06Related solutions

Create an SSH key pair with ssh-keygen (Ed25519)
LinuxTerminaldevelopersecurity

Generate a modern Ed25519 public/private key pair in ~/.ssh for authenticating to servers and Git platforms without passwords.

Low risk ✓ 2026-09-17
Change file permissions with chmod
LinuxFilesTerminalsecurity

Add or remove read, write, and execute permission for the owner, group, or others using symbolic or octal modes.

Medium risk ✓ 2026-09-17
Allow a port through the firewall with ufw
Linuxnetworksecurity

Add a UFW rule to permit inbound traffic on a TCP or UDP port, such as SSH on port 22.

High risk ✓ 2026-09-17