Rkhunter is a program that finds rootkits on a Linux server. Rootkits are installed by hackers to always have access to the server. In this document, you can see how to prevent the use of rkhunter rootkits in Ubuntu. To begin installing Rkhunter, you must first install some prerequisites, including a number of prerequisites for using Rkhunter correctly. This can be done using the following command:
apt-get install binutils libreadline5 libruby ruby ruby ssl-cert unhide.rb mailutils
This utility will be downloaded using wget. If wget is not already installed on your system, then you can enter the following command:
apt-get install wget
After successful installation of wget, you need to download Rkhunter itself. This can be done using the following command:
Next, you need to deploy the download
tar xzvf rkhunter*
Then go to the Rkhunter directory
Next install Rkhunter
./installer.sh --layout /usr --install
If everything was made well, the installation will show the following output:
Checking system for:
Rootkit Hunter installer files: found
A web file download command: wget found
Checking installation directory "/usr": it exists and is writable.
Checking installation directories:
Directory /usr/share/doc/rkhunter-1.4.2: creating: OK
Directory /usr/share/man/man8: exists and is writable.
Directory /etc: exists and is writable.
Directory /usr/bin: exists and is writable.
Directory /usr/lib: exists and is writable.
Directory /var/lib: exists and is writable.
Directory /usr/lib/rkhunter/scripts: creating: OK
Directory /var/lib/rkhunter/db: creating: OK
Directory /var/lib/rkhunter/tmp: creating: OK
Directory /var/lib/rkhunter/db/i18n: creating: OK
Directory /var/lib/rkhunter/db/signatures: creating: OK
Installing check_modules.pl: OK
Installing filehashsha.pl: OK
Installing stat.pl: OK
Installing readlink.sh: OK
Installing backdoorports.dat: OK
Installing mirrors.dat: OK
Installing programs_bad.dat: OK
Installing suspscan.dat: OK
Installing rkhunter.8: OK
Installing ACKNOWLEDGMENTS: OK
Installing CHANGELOG: OK
Installing FAQ: OK
Installing LICENSE: OK
Installing README: OK
Installing language support files: OK
Installing ClamAV signatures: OK
Installing rkhunter: OK
Installing rkhunter.conf: OK
Data files contain information about all possible threats. Regular file updates are essential for the entire system. This can be updated using the Rkhunter command
The following list will appear:
[ Rootkit Hunter version 1.4.2 ]
Checking rkhunter data files...
Checking file mirrors.dat [ No update ]
Checking file programs_bad.dat [ Updated ]
Checking file backdoorports.dat [ No update ]
Checking file suspscan.dat [ No update ]
Checking file i18n/cn [ No update ]
Checking file i18n/de [ No update ]
Checking file i18n/en [ No update ]
Checking file i18n/tr [ No update ]
Checking file i18n/tr.utf8 [ No update ]
Checking file i18n/zh [ No update ]
Checking file i18n/zh.utf8 [ No update ]
Enabling email notifications
Rkhunter can be configured to send an email when a threat is detected. To configure this feature, start by opening the rkhunter.conf file:
Search for MAIL-ON-WARNING and add your email address. You can scroll through the configuration for more options if you want, however, by default everything should work fine. You can check your config file:
If there is no output, your config file is valid!