rkhunter(8)

🦋 rkhunter 🦋

okay so this is the System Manager's Manual page for rkhunter, aka RootKit Hunter, and honestly she's kind of a big deal. 💅

✨ NAME ✨

rkhunter — RootKit Hunter. bestie, the name literally tells you what she does. 🎀

🌸 SYNOPSIS 🌸

rkhunter {--check | --unlock | --update | --versioncheck |
          --propupd [{filename | directory | package name},...] |
          --list [tests | {lang | languages} | rootkits | perl |
                  propfiles] |
          --config-check | --version | --help} [options]

💖 DESCRIPTION 💖

rkhunter is a shell script that runs a whole bunch of checks on your local system to try and detect known rootkits and malware. she also checks whether commands have been modified, whether the system startup files have been modified, and does various checks on your network interfaces — including checking for listening applications. 👑

she's been written to be as generic as possible, so she should run on most Linux and UNIX systems. she comes with some support scripts in case certain commands are missing from your system, and some of those support scripts are perl scripts. but listen: rkhunter does require certain commands to be present for her to be able to execute. also, some tests need specific commands, and if those aren't there, the test just gets skipped. no drama, but facts are facts. 🦋

rkhunter needs to be run under a Bourne-type shell — typically bash or ksh. she can be run as a cron job or straight from the command-line. ✨

💅 COMMAND OPTIONS 💅

if you give no command option at all, then --help is assumed. and rkhunter will return a non-zero exit code if any error or warning occurs. periodt. 💀

• -c, --check — tells rkhunter to perform various checks on the local system. the result of each test gets displayed on stdout. if anything suspicious is found, a warning is displayed. a log file of the tests and results is automatically produced. she suggests running this regularly so you can make sure your system hasn't been compromised. 🫶
• --unlock — simply unlocks (removes) the lock file. if this option is used on its own, then no log file is created. that's it, that's the whole vibe. 🔓
• --update — makes rkhunter check if there's a later version of any of her text data files. a command-line web browser — for example wget or lynx — must be present on the system when using this option. she suggests running this regularly so the data files stay up to date. if you're using this option via cron, then it's recommended that you also use --nocolors. 🌈

exit codes for this one are specific, so pay attention: an exit code of zero means no updates were available. an exit code of one means a download error occurred. and a code of two means no error occurred, but updates were available and have been installed. 🎀

• --propupd [{filename | directory | package name},...] — one of the checks rkhunter performs is comparing various current file properties of various commands against the ones she previously stored. this command option makes rkhunter update her data file of stored values with the current values.

if the filename option is used, then it must either be a full pathname, or a plain file name (for example, 'awk'). when used, only the entry in the file properties database for that file gets updated. if the directory option is used, then only those files listed in the database that are in the given directory get updated. similarly, if the package name option is used, then only those files in the database which are part of the specified package get updated. the package name must be the base part of the name — no version numbers should be included, for example, 'coreutils'. package names will, of course, only be stored in the file properties database if a package manager is being used. if a package name is the same as a file name — for example, 'file' could refer to the 'file' command or to the RPM 'file' package (which contains the 'file' command) — the package name will be used. if no specific option is given, then the entire database is updated.

WARNING: it is the user's responsibility to ensure that the files on the system are genuine and from a reliable source. rkhunter can only report if a file has changed, but not what caused the change. hence, if a file has changed, and the --propupd command option is used, then rkhunter will assume that the file is genuine. 😭 bestie please be careful with this one.

• --versioncheck — makes rkhunter check if there's a later version of the program. a command-line web browser must be present on the system when using this option. if this option is used via cron, then it's recommended that you also use --nocolors. 🌸

exit codes: an exit code of zero means no new version was available. an exit code of one means an error occurred downloading the latest version number. and a code of two means no error occurred, but a new version is available. 👑

• --list [tests | {lang | languages} | rootkits | perl | propfiles] — this command option lists some of the supported capabilities of the program, and then exits. the tests option lists the currently available test names (see the README file for more details about test names). the languages option lists the currently available languages, and the rootkits option lists the rootkits that are searched for by rkhunter. the perl option lists the installation status of the perl command and perl modules that may be used by some of the tests. note that it is not required to install these modules. however, if rkhunter is forced to use perl to execute a test, then the module must be present. the propfiles option lists the file names that are used to generate the file properties database. if no specific option is given, then all the lists, except for the file properties database, are displayed. 💖
• -C, --config-check — makes rkhunter check her configuration file(s), and then exit. the program runs through her normal configuration checks as specified by the enable and disable options on the command-line and in the configuration files. that is, only the configuration options for tests which would normally run are checked. in order to check all the configured options, use the --enable all --disable none options on the command line. additionally, the program checks to see if there are any unrecognised configuration options. if any configuration problems are found, then they will be displayed and the return code will be set to 1. she suggests using this option whenever the configuration file(s) have been changed. 🧚
• -V, --version — makes rkhunter display her version number, and then exit. short and iconic. 💅
• -h, --help — displays the help screen menu, and then exits. 🎀

🌈 OPTIONS 🌈

rkhunter uses a configuration file named rkhunter.conf for many of her configuration options. she can also use a local configuration file named rkhunter.conf.local, and a directory named rkhunter.d if it's present. both the local configuration file and the local directory must be in the same directory as the main configuration file. the installer does not create the local file or directory, but one, or both, can be created by the user if required. if a directory is used, then within the directory any file ending in .conf will be treated as a local configuration file. 🦋

some options can also be specified on the command-line, and these will override the equivalent configuration file options. the configuration file options are well documented within the main configuration file itself. the following are the command-line options. the defaults mentioned here are the program defaults, unless explicitly stated as the configuration file default. ✨

• --appendlog — by default a new log file will be created when rkhunter runs, and the previous log file will be renamed by having .old appended to its name. this option tells rkhunter to append to the existing log file. if the log file does not exist, then it will be created. 🫶
• --bindir <directory>... — this option modifies which directories rkhunter looks in to find the various commands she requires (that is, her PATH). the default is the root PATH, and an internal list of some common command directories. by default a specified directory will be appended to the default list. however, if the directory name begins with the '+' character, then it will be prepended to the list (that is, it will be put at the start of the list). 💅
• --cs2, --color-set2 — by default rkhunter displays her test results in color. the colors used are green for successful tests, red for failed tests (warnings), and yellow for skipped tests. these colors are visible when a black background is used, but are difficult to see on a white background. this option tells rkhunter to use a different color set which is more suited to a white background. 🌸
• --configfile <file> — the installation process automatically tells rkhunter where her configuration file is located. however, if necessary, this option can be used to specify a different pathname. if a local configuration file, or directory, is to be used, then it must reside in the same directory as the configuration file specified by this option. 🎀
• --cronjob — this is similar to the --check command option, but it disables several of the interactive options. when this option is used, --check, --nocolors and --skip-keypress are assumed. by default no output is sent to stdout, so the --report-warnings-only option may be useful with this option. 🕰️
• --dbdir <directory> — the installation process automatically configures where the data files are stored for rkhunter. however, if necessary, this option can be used to specify a different directory. the directory can be read-only, after installation, provided that neither of the --update or --propupd options are specified, and that the --versioncheck option is not specified if ROTATE_MIRRORS is set to 1 in the configuration file. 🔥
• --debug — okay so this one is lowkey a dev-only secret 🤫 it's mainly for the developers. It produces no output on stdout. Regular logging keeps going as per default or as specified by --logfile, and the debug output lands in a randomly generated filename that starts with /tmp/rkhunter-debug.
• --disable <test>[,<test>...] — tells rkhunter not to run the tests you name. Read the README file for more info about test names, bestie. By default no tests are disabled. ✨
• --display-logfile — the way this one just shows the logfile on your screen once rkhunter has finished 💅
• --enable <test>[,<test>...] — tells rkhunter to only run the tests you name. If only one test name is given, other than all, then --skip-keypress is assumed. Read the README file for more info about test names. By default all tests are enabled, and all the test names are listed below under TESTS 🫶
• --hash {MD5 | SHA1 | SHA224 | SHA256 | SHA384 | SHA512 | NONE | <command>} — both the file properties check and the --propupd command option use a hash function to work out a file's current hash value, and this tells rkhunter which one. The MD5 and SHA options look for the relevant command and, if it isn't found, a perl support script is used to see whether a perl module supporting the function is installed. Alternatively you can name a specific command. A value of NONE means the hash values are not obtained or used as part of the file properties check. Default is SHA256.

🚨 Systems using prelinking must use either MD5, SHA1 or NONE. No cap, that one's not negotiable.

• --lang, --language <language> — picks which language is used for the displayed tests and results 🌈 You can see the currently supported languages with the --list command option. Default is en (English). If a message to be displayed can't be found in the language file, the English version gets used — so the English language file must always be present, periodt. The --update command option updates the language files when new versions are available.
• -l, --logfile [file] — by default rkhunter writes out a log file, at /var/log/rkhunter.log. You can change that location with this option. If /dev/null is specified as the log file, then no log file is written. If no specific file is given, the default is used. By default rkhunter creates a new log file each time it runs — any previously existing logfile is moved out of the way and gets .old appended to it 💀
• --noappend-log — reverts rkhunter to its default behaviour of creating a new log file rather than appending to it.
• --nocf — this one is only valid when the command-line --disable option is used. When --disable is used, by default the configuration file option to disable tests is also used to determine which tests to run. If only the --disable option is to determine which tests run, then --nocf must be given. iykyk 🧚
• --nocolors — causes the result of each test to not be displayed in a specific color. The default color — usually the reverse of the background color — is used (typically that's just black and white).
• --nolog — tells rkhunter not to write anything to a log file.
• --nomow, --no-mail-on-warning — the config file has an option that sends a simple email message to a user should rkhunter detect any warnings during system checks. This command-line option overrides the config file option and prevents an email from being sent. The config file default is not to email a message. 🎀
• --ns, --nosummary — when --check is used, a short summary of results is displayed at the end by default. This stops the summary from being displayed.
• --novl, --no-verbose-logging — during some tests rkhunter logs a lot of information. This option reduces the amount of logging and so can improve performance… but the log file will contain less info should any warnings occur 😭 By default verbose logging is enabled.
• --pkgmgr {RPM | DPKG | BSD | BSDng | SOLARIS | NONE} — used during the file properties check or when the --propupd command option is given. It tells rkhunter that the current file property values should be obtained from the relevant package manager. See the README file for more details. Default is NONE, which means don't use a package manager.
• -q, --quiet — tells rkhunter not to display any output. Super useful when you're only checking the exit code. Other options can be used alongside to force only specific items to be displayed. 🤫
• --rwo, --report-warnings-only — only warning messages get displayed. Great when rkhunter is run via cron. Other options can force other bits of info to be displayed too.
• --sk, --skip-keypress — when --check is used, after certain sections of tests the user gets prompted to press the return key to continue. This disables that and rkhunter runs until all the tests have completed 🏃‍♀️

If this option hasn't been given and the user is prompted to press return, a single s character — upper- or lowercase — may be given followed by the return key. rkhunter will then continue the tests without prompting again (as if this option had been given). Slay.

• --summary — causes the summary of test results to be displayed. This is the default. ✨
• --syslog [facility.priority] — when --check is used, this causes the start and finish times to be logged to syslog. Default is not to log anything to syslog, but if the option is used the default level is authpriv.notice.
• --tmpdir <directory> — the installation process automatically configures where temporary files are created, but if necessary this option specifies a different directory.

🚨 The directory must not be a symbolic link, and must be secure (root access only). Do not skip this one, bestie.

• --vl, --verbose-logging — tells rkhunter that when it runs some tests it should log as much information as possible. Useful when diagnosing why a warning occurred, but obviously it takes more time. Default is to use verbose logging.
• -x, --autox — rkhunter will try to detect if the X Window system is in use. If it is, the second color set gets used automatically (see the --color-set2 option). This lets rkhunter run on, like, a server console (no X, so the default color set) and on a user's terminal (X in use, so the second color set) — and in both cases it uses the correct one 👑 The config file default is to try and detect X.
• -X, --no-autox — stops rkhunter from automatically detecting whether the X Window system is being used. See --autox above. 💜

---

🌸 TESTS 🌸

Literally the original page just says:

[This section to be written]

so that's what we have to work with, no cap. Here's what's there:

• additional_rkts — this test is for SHORT_EXPLANATION. It works as part of GROUP. Corresponding configuration file entries: ONE=one, TWO=two and for white-listing THREE=three,three. Simple globbing (/dev/shm/file-*) works. 🦋
• all
• apps
• attributes
• avail_modules
• deleted_files
• filesystem
• group_accounts
• group_changes
• hashes
• hidden_ports
• hidden_procs
• immutable
• known_rkts
• loaded_modules
• local_host
• malware
• network
• none
• os_specific
• other_malware
• packet_cap_apps
• passwd_changes
• ports
• possible_rkt_files
• possible_rkt_strings
• promisc
• properties
• rootkits
• running_procs
• scripts
• shared_libs
• shared_libs_path
• startup_files
• startup_malware
• strings
• suspscan
• system_commands
• system_configs
• trojans

---

🎀 FILES 🎀

For a default installation:

/etc/rkhunter.conf
/var/log/rkhunter.log

---

🦋 SEE ALSO 🦋

• See the CHANGELOG file for recent changes.
• The README file has info about installing rkhunter, plus specific sections on test names and using package managers.
• The FAQ file should also answer some questions 💖

---

👑 LICENSING 👑

RootKit Hunter is licensed under the GPL, copyright Michael Boelen. See the LICENSE file for details of GPL licensing.

---

🌈 CONTACT INFORMATION 🌈

This software was developed by the RootKit Hunter project team. To report bugs, patches, comments and questions, please go to:

http://rkhunter.sourceforge.net/

---

and that's the whole page, bestie 🫶 this version is dated June 2017 and it's the rkhunter(8) page — go forth and vibe check your system 💅✨