rkhunter (Rootkit Hunter) is a security tool that scans for rootkits, backdoors, and local exploits on Linux systems. It checks for known malware, suspicious file attributes, hidden files, and unusual system configurations. This guide installs and configures rkhunter on Ubuntu 26.04 LTS.

Tested and valid on:

  • Ubuntu 26.04 LTS

Prerequisites

  • Ubuntu 26.04 LTS
  • A user with sudo privileges

Step 1 – Install rkhunter

sudo apt update
sudo apt install rkhunter -y
rkhunter --version

Step 2 – Update the Database

sudo rkhunter --update

Step 3 – Set Baseline Properties

sudo rkhunter --propupd

Step 4 – Run a Full System Check

sudo rkhunter --check --sk

Step 5 – Review the Log

sudo cat /var/log/rkhunter.log | grep -E 'Warning|Found'

Step 6 – Configure rkhunter

sudo nano /etc/rkhunter.conf

Important settings:

[email protected]
APP_WHITELIST=''
SCRIPTWHITELIST=/usr/bin/lwp-request

Step 7 – Schedule Daily Scans

sudo nano /etc/cron.daily/rkhunter

Add:

#!/bin/bash
rkhunter --cronjob --update --quiet
sudo chmod +x /etc/cron.daily/rkhunter

Step 8 – Also Install chkrootkit

sudo apt install chkrootkit -y
sudo chkrootkit

Conclusion

rkhunter is configured with daily scans on Ubuntu 26.04 LTS. Run both rkhunter and chkrootkit for better coverage, and always investigate warnings carefully before dismissing them.