How to Install and Run chkrootkit on Linux and cPanel Servers

Updated: 28 September 2026 · Applies to: chkrootkit 0.58b and 0.59 on Ubuntu 24.04 and 26.04, Debian 13, AlmaLinux and Rocky Linux 9 and 10 (including cPanel servers)

chkrootkit checks a Linux server for signs of known rootkits: modified system programs, hidden processes, network interfaces in promiscuous mode and deleted login records. It is a quick second opinion, not a guarantee. A clean result does not prove the server is safe, and some findings are false alarms that you need to check by hand. We tested the steps below with the Debian package and with chkrootkit 0.59 built from source on AlmaLinux 10.

Ubuntu and Debian: install the package

apt install chkrootkit
chkrootkit -q

The package also runs a daily scan (a systemd timer and a cron job) and mails the result to root. The settings are in /etc/chkrootkit/chkrootkit.conf: RUN_DAILY turns the daily scan on or off, DIFF_MODE="true" reports only the differences from the expected output saved in /var/log/chkrootkit/log.expected, and MAILTO sets who gets the report.

AlmaLinux, Rocky Linux and cPanel servers: build from source

chkrootkit is not in the AlmaLinux, Rocky Linux or EPEL repositories for version 9 or 10, so build it from the official release. The build needs the static C library from the CRB repository (enabled only for this command), and the scan uses netstat from net-tools:

dnf install --enablerepo=crb gcc make glibc-static net-tools
cd /usr/local/src
curl -O ftp://ftp.chkrootkit.org/pub/seg/pac/chkrootkit.tar.gz
curl -O ftp://ftp.chkrootkit.org/pub/seg/pac/chkrootkit.md5
md5sum chkrootkit.tar.gz && cat chkrootkit.md5
tar xzf chkrootkit.tar.gz
cd chkrootkit-0.59
make sense
./chkrootkit -q

The two checksums must match. The folder name follows the version in the download (0.59 was current in September 2026).

Read the results

• -q prints only findings. Without it, chkrootkit lists every test with "not found" or "not infected".
• Lists of hidden files such as /usr/lib/.build-id are normal on AlmaLinux and Rocky Linux. Check any hidden file you do not recognise with rpm -qf or dpkg -S.
• "PACKET SNIFFER" next to a network service such as NetworkManager or systemd-networkd is usually a false alarm: these services open raw sockets for DHCP.
• Anything else, such as "INFECTED" on a system program, needs a closer look. Compare the file with the package (rpm -V package or debsums), and scan again with a second tool such as rkhunter.

Daily scan on AlmaLinux and Rocky Linux

Create /etc/cron.daily/chkrootkit:

#!/bin/sh
cd /usr/local/src/chkrootkit-0.59 && ./chkrootkit -q 2>&1 | mail -E -s "chkrootkit report for $(hostname)" admin@example.com

chmod 700 /etc/cron.daily/chkrootkit

The -E option of mail (s-nail) skips sending when the report is empty. The server needs a working mail setup for the report to arrive.

If a rootkit is found

A real rootkit means the attacker had root access. Cleaning a compromised server is not reliable: back up your data, set up a fresh server, restore the data after checking it, and change every password and key that was on the old server. Keep the server patched with dnf upgrade or apt upgrade to prevent the next one. If you are unsure, you can hire an expert to review the findings.

Official documentation: chkrootkit project site.