How To Install Rootkit Hunter on CentOS 5 and 6

Updated: 28 September 2026 · Applies to: Ubuntu 24.04, Debian 12, AlmaLinux 9 and Rocky Linux 9

CentOS 5 and 6 are end of life. These steps are for Ubuntu 24.04, Debian 12, AlmaLinux 9 and Rocky Linux 9.

Rootkit Hunter (rkhunter) checks a Linux server for rootkits, backdoors and suspicious changes to system files.

Install

dnf install epel-release && dnf install rkhunter    # AlmaLinux / Rocky
apt install rkhunter                                 # Ubuntu / Debian

First run

1. Update the data files: rkhunter --update.
2. Record the current state of system files as "known good" (do this on a clean system, and again after each system update): rkhunter --propupd.
3. Run a check without pauses: rkhunter --check --sk.

Warnings are summarised at the end; details are in /var/log/rkhunter/rkhunter.log (AlmaLinux/Rocky) or /var/log/rkhunter.log (Ubuntu/Debian).

Ubuntu and Debian settings

• Ubuntu's configuration disables online updates. To use --update, set UPDATE_MIRRORS=1, MIRRORS_MODE=0 and WEB_CMD="" in /etc/rkhunter.conf.
• In /etc/default/rkhunter, CRON_DAILY_RUN="true" enables a daily check, and APT_AUTOGEN="true" refreshes the file properties after package updates, which avoids false warnings.

Reading the results

A warning is not proof of an infection. Common false positives are files changed by a system update (run --propupd again) and scripts that replaced binaries on purpose. Investigate anything you cannot explain, and contact our support team if you suspect a compromise.