rkhunter(8)
rkhunter is a rootkit and malware scanner that searches for hidden processes, backdoors, and suspicious files on Linux systems.
Synopsis
rkhunter [OPTION]... [FILE]...Description
rkhunter (Rootkit Hunter) is a security scanning tool that checks for signs of rootkits, backdoors, and other malware on Linux and Unix systems. It performs checks against known malware signatures, suspicious file permissions, hidden processes, and system vulnerabilities.
The scanner can be run in interactive mode or as an automated check, making it suitable for both manual security audits and scheduled monitoring via cron jobs. Results are logged and can be reported to administrators.
Common options
| Flag | What it does |
|---|---|
--check | Run all checks on the system; the primary scanning mode |
--update | Update the rootkit database and malware signatures |
--propupd | Update the file properties database for baseline comparisons |
-l, --logfile FILE | Write output to specified log file instead of stdout |
-r, --report | Generate a report of previous scan results |
-q, --quiet | Run in quiet mode, suppress normal output |
--cronjob | Run in cron mode (non-interactive, minimal output) |
-x, --skip-keypress | Run without waiting for key presses between screens |
--enable OPTION | Enable a specific check option (e.g., --enable all) |
--disable OPTION | Disable a specific check option to skip it |
--config FILE | Use alternate configuration file instead of default |
Examples
Run a complete system scan without waiting for key presses between screens
rkhunter --check --skip-keypressUpdate the malware signature database to the latest version
rkhunter --updatePerform a scan in quiet mode and save all output to a log file
rkhunter --check --quiet --logfile /var/log/rkhunter.logRun rkhunter from cron with minimal output, suitable for scheduled security audits
rkhunter --cronjob --logfile /var/log/rkhunter-cron.log 2>&1Display a report of the last scan results
rkhunter --reportRun all checks except the suspicious files check
rkhunter --check --enable all --disable suspicious.filesUpdate the file properties database for future baseline comparisons
rkhunter --propupd