Rootkit Hunter — universally known by its command name, rkhunter — is a long-standing intrusion-detection scanner for Unix and Unix-like systems. It is the tool that answers the question “has someone already been here?”: rather than watching traffic in real time, rkhunter walks a machine and checks it against the fingerprints of known rootkits, backdoors, sniffers and local exploits, alongside the tell-tale file-permission, hidden-file and kernel-module anomalies that a compromised host tends to leave behind. The project began in 2003 as the work of Michael Boelen, passed in 2006 to the Rootkit Hunter Development Team led by John Horne and unSpawn, and since December 2023 has been sponsored by Dogsbody Technology; it remains community-led and open source. It is written as a shell/Perl script with no compiled daemon, so it runs anywhere a POSIX shell and Perl are present. The current release is 1.4.6 (February 2018); Debian trixie packages it as rkhunter 1.4.6-13.

Key Features

• System binary and file-integrity checks — rkhunter records a baseline of the system’s core commands and configuration files with SHA256 hashes and reports anything that has changed. The snapshot is refreshed deliberately with rkhunter --propupd after legitimate upgrades, so a changed /usr/bin binary is surfaced as suspicious rather than silently accepted. It also flags executables with anomalous file permissions (setuid/setgid oddities) and hidden files in system directories.
• Rootkit signature database — the package ships and checks against data files such as backdoorports.dat (ports opened by known backdoors), programs_bad.dat and suspscan.dat. Each entry is tested and reported as [ Not found ], [ None found ] or [ OK ] in the scan output, covering dozens of historical and modern threats (Suckit, Adore, Jynx, Phalanx, Diamorphine, Ebury, Mokes, Proton and many more).
• Kernel, memory and network checks — suspicious strings in loaded kernel modules, loaded-module name checks, login backdoors, sniffer log files, suspicious large shared-memory segments (with ALLOWIPCPID / ALLOWIPCUSER / IPC_SEG_SIZE tunables), backdoor ports and promiscuous network interfaces.
• Account, boot and configuration checks — passwordless accounts, root-equivalent UID 0 accounts, passwd/group changes, local hostname and startup files, plus SSH configuration tests for dangerous settings such as root login.
• Optional deep scanners — if the skdet tool or the C versions of unhide / unhide-tcp are present, rkhunter uses them to hunt hidden processes and hidden ports; a per-test --enable / --disable switch lets you tune exactly what runs.
• Self-updating — --update and --versioncheck pull refreshed signature and translation data from a mirror (configurable, including a local mirror), and the scan itself can optionally look inside files rather than only at metadata.
• Built for unattended running — designed to be driven from cron with --cronjob, with a warning-only mode (--report-warnings-only) and an --sk flag to suppress keypresses, so the result can be mailed to an administrator each night.
• Configurable and translated — settings live in rkhunter.conf, with a rkhunter.conf.local overlay for machine-specific overrides; output and messages are available in multiple languages (the shipped i18n set includes English, German, Japanese and Chinese).

Why Use It

rkhunter’s value is that it is small, dependency-light and honest. It needs nothing more than a shell, Perl and the usual core utilities, it installs as a handful of scripts and data files rather than a service, and it makes no attempt to be a real-time IDS — it is a scheduled, repeatable integrity check you can read the output of. Because it combines file hashing, rootkit signatures and ordinary system misconfiguration checks in one pass, a single cron entry gives a broad weekly or nightly view of a server’s health. Its age is a feature as much as a limitation: the signature set is a long-maintained catalogue of real-world rootkits, and the tool’s behaviour is well understood and well documented. Its own documentation is candid that it does not guarantee a system is clean, and recommends pairing it with other scanners — which is exactly the right way to deploy it.

Use Cases

• Scheduled server hygiene — a nightly rkhunter --cronjob --report-warnings-only job that emails only when something changes, giving early warning of tampering without daily noise.
• Post-incident triage — when a host is suspected of compromise, an rkhunter pass quickly highlights changed binaries, hidden files and suspicious kernel state to investigate.
• File-integrity baselining — using --propupd after patch windows turns rkhunter into a lightweight host-based integrity monitor for critical directories.
• Hardening reviews — the configuration and account checks catch weak SSH settings and stray passwordless or UID 0 accounts as a side effect of the rootkit scan.
• Defence in depth — running alongside an antivirus, an audit daemon and a vulnerability scanner so that no single tool is the only thing standing between a box and a rootkit.

Alternatives

• Lynis — a broader system-hardening and security-audit tool that focuses on configuration and compliance rather than rootkit signatures; the two complement each other.
• ClamAV — signature-based malware detection for files and mail, a different layer from rkhunter’s host-integrity checks.
• Trivy, OWASP ZAP — scanning of software artefacts and web applications rather than the running host.
• Wazuh, Suricata and Snort — continuous runtime detection and monitoring, where rkhunter is the periodic offline check.

Platform

Linux and other POSIX systems (the Debian package targets Linux; upstream supports the common Unix clones) · requires a POSIX shell, Perl and standard utilities such as cat, sed, head and tail, plus a download tool (wget, curl, links, lynx or GET) for --update · installed via the distribution package (Debian/Ubuntu apt install rkhunter, Fedora/RHEL RPM spec included) or the upstream installer.sh tarball.

Licence

GPL-2.0 (GNU General Public License, version 2) — free and open source, with no feature restrictions or account requirement. The project is community-led and sponsored by Dogsbody Technology.

Website

rkhunter.dev · the original SourceForge project home · source on GitHub · also see the Security & Privacy category and the full directory for more tools that keep systems honest.