How to Install and Use rkhunter (Rootkit Hunter) on Linux

Updated: 12 October 2026 · Applies to: rkhunter 1.4.6 on Ubuntu 26.04 and AlmaLinux 10 with EPEL (both tested); the same packages exist for Debian 13, Rocky Linux and Fedora

rkhunter (Rootkit Hunter) scans a Linux server for known rootkits, backdoors and unexpected changes to system programs. Install it from your distribution's repositories, record a baseline of your system files, then run a check:

sudo apt install rkhunter                              # Ubuntu, Debian
sudo dnf install epel-release && sudo dnf install rkhunter   # AlmaLinux, Rocky Linux
sudo rkhunter --propupd          # record the current state of system files
sudo rkhunter --check --sk       # run a scan

Warnings go to /var/log/rkhunter.log (Debian, Ubuntu) or /var/log/rkhunter/rkhunter.log (AlmaLinux, Rocky Linux). Version 1.4.6, released in February 2018 according to the project site, is still the current release, so treat rkhunter as one check among several, not as a complete malware scanner.

What rkhunter checks

• File properties: hashes, permissions, owners and sizes of about 150 system commands (155 files on our Ubuntu test), compared with the baseline from --propupd.
• Known rootkits: files, folders and strings of 461 known rootkits and worms in our test run.
• System checks: hidden files and processes, suspicious ports, SSH settings such as root login, system logging and startup files.

List all test names with rkhunter --list tests.

Install rkhunter

• Ubuntu and Debian: sudo apt install rkhunter. On a server without a mail server, this also installs Postfix, because rkhunter recommends a mail transport for its reports (seen on Ubuntu 26.04). To skip it: sudo apt install --no-install-recommends rkhunter.
• AlmaLinux, Rocky Linux and RHEL: rkhunter is in EPEL. sudo dnf install epel-release, then sudo dnf install rkhunter. AlmaLinux 10 installed rkhunter-1.4.6-31.el10_2.
• Fedora: sudo dnf install rkhunter.

Check it: rkhunter --version prints Rootkit Hunter 1.4.6.

First scan, step by step

1. Update the data files (AlmaLinux, Rocky Linux, Fedora): sudo rkhunter --update. Exit code 2 means files were updated, 0 that none were needed, 1 an error. On Debian and Ubuntu the package turns online updates off (WEB_CMD=/bin/false and UPDATE_MIRRORS=0 in /etc/rkhunter.conf), so every file shows [ Update failed ]; that is expected, and the data files are updated with the package instead.
2. Record the baseline on a system you trust, ideally right after installation:

   $ sudo rkhunter --propupd
   [ Rootkit Hunter version 1.4.6 ]
   File created: searched for 178 files, found 155

   The rkhunter FAQ points out that it is your responsibility to make sure these files are genuine: a baseline taken on a compromised server hides the problem.
3. Check the configuration: sudo rkhunter -C prints nothing when the configuration is valid.
4. Run the scan: sudo rkhunter --check --sk. --sk stops it pausing for Enter between sections. Add --rwo to print only warnings. The exit code is 1 if anything was flagged. The full scan took about 16 minutes in our lab container on one shared CPU core (a lab figure, not a benchmark), so start it inside tmux.
5. Read the summary and warnings: sudo grep -A15 'System checks summary' /var/log/rkhunter.log and sudo grep -i warning /var/log/rkhunter.log.

Understanding warnings and false positives

A warning means "look at this", not "you have been hacked". Lab output from our Ubuntu 26.04 test container with --rwo:

Warning: Suckit Rootkit additional checks         [ Warning ]
         Error from '/usr/bin/stat' command when checking '/sbin/init'
Warning: The kernel modules directory '/lib/modules' is missing or empty.
Warning: No running system logging daemon has been found.

The summary even listed Possible rootkits: 1 (Suckit). None of these was a rootkit: a container has no /sbin/init, no kernel modules and no syslog. Always read what was checked before you act.

The most common real-life warning appears after updates, because updated programs no longer match the baseline:

Warning: The file properties have changed:
         File: /usr/bin/ls
         Current hash: 59e37b07e1a2...
         Stored hash : f84e76ea4da1...

(Shortened.) If you know the change came from your package manager, refresh the baseline with sudo rkhunter --propupd; in our test, the next check was clean. On Debian and Ubuntu, set APT_AUTOGEN="true" in /etc/default/rkhunter and the baseline is refreshed automatically after every apt run.

To silence a warning you have checked, add an exception to /etc/rkhunter.conf.local (rkhunter reads it after /etc/rkhunter.conf, and package updates leave it alone), for example:

SCRIPTWHITELIST=/usr/bin/lwp-request
ALLOWHIDDENDIR=/etc/.java
ALLOW_SSH_ROOT_USER=prohibit-password

Use the paths that exist on your server: ALLOW_SSH_ROOT_USER must match PermitRootLogin in your SSH configuration. Then run sudo rkhunter -C. A whitelisted file that does not exist stops every run with Invalid SCRIPTWHITELIST configuration option: Non-existent pathname: /usr/bin/lwp-request (we saw the same for /usr/sbin/adduser in a minimal Ubuntu image); remove the line or install the program.

Daily scans and email reports

• AlmaLinux, Rocky Linux (EPEL): /etc/cron.daily/rkhunter is active after installation. It runs --update and then a --cronjob --report-warnings-only scan, and mails the result to MAILTO in /etc/sysconfig/rkhunter (root@localhost by default). Change it to an address you read.
• Debian and Ubuntu: the daily scan is off until you set CRON_DAILY_RUN="true" in /etc/default/rkhunter. Reports go to REPORT_EMAIL (root by default) through /usr/sbin/sendmail, so a working mail setup is needed.
• On any system you can instead set MAIL-ON-WARNING=you@example.com in /etc/rkhunter.conf.local, or schedule rkhunter --cronjob --report-warnings-only yourself (see how to schedule tasks in Linux).

If rkhunter finds something real

Compare the flagged file with the package (dpkg --verify PACKAGE or rpm -V PACKAGE), check a second tool such as chkrootkit, and look at logins and running processes. For a confirmed rootkit, the rkhunter FAQ recommends a clean installation rather than trying to repair the system: restore your data from a backup made before the compromise. See also three tools to scan a Linux server for malware and rootkits, security audits with Lynis and what to do if your site is hacked. If you want an engineer to review a server for you, Ucartz offers Hire an expert.

Official documentation: Rootkit Hunter project site (README and FAQ).