How To Install Rootkit Hunter on CentOS 6

In this tutorial, we will show you how to install Rootkit Hunter on CentOS 6. For those of you who didn’t know, Rootkit Hunter (rkhunter) is a Unix-based tool that scans for rootkits, backdoors, and possible local exploits. Rkhunter checks to see whether the binary files or system startup files have been modified, and performs various checks on the network interfaces, including checks for listening services and applications. Rkhunter runs on most Linux and UNIX systems. It can be run from the command line, but it can also be scheduled to execute on a daily basis as a cron job.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple. I will show you the step-by-step installation rkhunter (Rootkit Hunter) on CentOS 6.

Here are some key points about Rootkit Hunter:

1. Detection of Rootkits: Rootkit Hunter is primarily used for the detection of rootkits on Linux systems. It does this by scanning the system for anomalies and known signatures associated with various types of rootkits. Rootkits often hide themselves and other malicious tools by manipulating system calls and processes. Rkhunter compares the checksums and attributes of important system files to a known good baseline to identify any discrepancies.
2. Additional Checks: Apart from rootkit detection, Rootkit Hunter performs various other checks to identify suspicious activities or potential security vulnerabilities. It checks for common security misconfigurations, backdoor programs, and signs of a system compromise.
3. Regular Updates: To stay effective against the evolving threat landscape, Rootkit Hunter requires regular updates. The tool relies on a database of signatures and characteristics associated with known rootkits and vulnerabilities. Users should ensure that they regularly update the rkhunter database to incorporate the latest threat intelligence.
4. Command-Line Interface: Rootkit Hunter is typically used through the command line. Users can run scans manually or set up automated scans using cron jobs to regularly check the system for potential threats. The tool generates a report after each scan, providing details on any suspicious files or activities that have been detected.
5. Open Source: Rootkit Hunter is an open-source tool, meaning that its source code is freely available to the public. This allows security professionals and Linux system administrators to inspect the code, contribute to its development, and customize it to suit their specific needs.
6. Limitations: While Rootkit Hunter is a valuable tool for enhancing the security of a Linux system, it’s important to note that no single tool can provide complete security. Security is a multi-layered approach, and using a combination of tools, practices, and regular system audits is essential for maintaining a secure environment.
7. Compatibility: Rootkit Hunter is compatible with various Linux distributions, including Ubuntu, Debian, CentOS, and others. It can be installed using package managers like APT (Advanced Package Tool) or Yum.

Prerequisites

• A server running one of the following operating systems: CentOS or RHEL-based.
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• SSH access to the server (or just open Terminal if you’re on a desktop).
• An active internet connection.
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install Rootkit Hunter on CentOS 6

Step 1. First, let’s start by ensuring your system is up-to-date.

sudo yum update

Step 2. Installing Rootkit Hunter on CentOS 6.

Now we download rkhunter using the following command.

wget http://downloads.sourceforge.net/project/rkhunter/rkhunter/1.4.2/rkhunter-1.4.2.tar.gz
tar xzfv rkhunter-1.4.2.tar.gz
cd rkhunter-1.4.2
./installer.sh --install --layout default

Update rkhunter:

rkhunter --update
rkhunter --propupd

Step 3. Rootkit Hunter manual scan.

Use the following command to perform a test scan on the local system:

rkhunter -c

Step 4. Adding a daily cron job

Set up a daily cron job on your Linux VPS:

nano /etc/cron.daily/rkhunter-cron.sh

#!/bin/sh
 (
 rkhunter --versioncheck
 rkhunter --update
 rkhunter -c --cronjob 
 ) | mail -s 'rkhunter Daily Check' your_email@address.com

Important: Do not forget to replace ‘your_email@address.com’ with your email address.

Execute the following command to make the script executable:

chmod +x /etc/cron.daily/rkhunter-cron.sh

For more information and options run the following command.

 rkhunter --help

Congratulations! You have successfully installed rootkit hunter. Thanks for using this tutorial for installing rkhunter on CentOS 6 systems. For additional help or useful information, we recommend you to check the official rkhunter website.