Rkhunter (Rootkit Hunter) - a malware scanner

Dominik Świtkowski
01 Jan, 2014

Rkhunter is a tool that scans our system for malware, mainly: rootkits, backdoors, exploits. Besides the above, the script also checks, among other things, startup files, the state of network interfaces, and the configuration of certain applications (e.g. sshd).
Rkhunter works successfully on many Linux distributions and BSD systems.

Rkhunter is available in many distributions as a ready-made package:

Installing the Rkhunter scanner

Debian/Ubuntu : aptitude install rkhunter
RedHat/CentOS : yum install rkhunter

If we want the freshest version, we can install from source.

We download the latest version: wget -O rkhunter.tar.gz http://sourceforge.net/projects/rkhunter/files/latest/download
We unpack it: tar -xzvf rkhunter.tar.gz
We go to the directory: cd rkhunter-*
When installing, we can of course use other options - I recommend the README file in the files directory: ./installer.sh --layout default --install
After a successful installation, a report should be displayed:

Checking system for:
 Rootkit Hunter installer files: found
 A web file download command: wget found
Starting installation:
 Checking installation directory "/usr/local": it exists and is writable.
 Checking installation directories:
  Directory /usr/local/share/doc/rkhunter-1.4.0: creating: OK
  Directory /usr/local/share/man/man8: creating: OK
  Directory /etc: exists and is writable.
  Directory /usr/local/bin: exists and is writable.
  Directory /usr/local/lib: exists and is writable.
  Directory /var/lib: exists and is writable.
  Directory /usr/local/lib/rkhunter/scripts: creating: OK
  Directory /var/lib/rkhunter/db: creating: OK
  Directory /var/lib/rkhunter/tmp: creating: OK
  Directory /var/lib/rkhunter/db/i18n: creating: OK
 Installing check_modules.pl: OK
 Installing filehashsha.pl: OK
 Installing stat.pl: OK
 Installing readlink.sh: OK
 Installing backdoorports.dat: OK
 Installing mirrors.dat: OK
 Installing programs_bad.dat: OK
 Installing suspscan.dat: OK
 Installing rkhunter.8: OK
 Installing ACKNOWLEDGMENTS: OK
 Installing CHANGELOG: OK
 Installing FAQ: OK
 Installing LICENSE: OK
 Installing README: OK
 Installing language support files: OK
 Installing rkhunter: OK
 Installing rkhunter.conf: OK
Installation complete

When installing the program from source, we should additionally install the Unhide program. Rkhunter installed from the official Debian repositories already has unhide as a dependency. Unhide is an application that detects hidden processes in the system. It's a good complement to the Rkhunter scanner. It can be installed from the repositories or compiled yourself. I won't describe the compilation, since it failed on several systems. The version installed from the repositories works correctly. You can verify this by checking the logs:

root@jvm grep -A2 "hidden_procs" /var/log/rkhunter.log
[20:49:15] Info: Starting test name 'hidden_procs'
[20:49:15] Info: Found the 'unhide' command: /usr/sbin/unhide
[20:49:15] Info: Found 'unhide' command version: 20100201

If after the above check we get a different message, look in the logs for: "Warning: The file '/usr/sbin/unhide' exists on the system, but it is not present in the rkhunter.dat file.". In that case you still need to run the command: rkhunter --propupd

Removing the scanner, if it was installed from source, is child's play - just go into the source directory and issue the command: ./installer.sh --layout default --remove; a correct removal will end with a report:

Starting uninstallation

Checking installation directory "/usr/local": it exists and is writable.
Removing installation files:
 Removing rkhunter.8: OK
 Removing /usr/local/bin/rkhunter: OK
 Removing /etc/rkhunter.conf: OK

Please remove any /etc/rkhunter.conf.* files manually.

Removing installation directories:
 Removing /usr/local/lib/rkhunter: OK
 Removing /usr/local/share/doc/rkhunter-1.4.0: OK
 Removing /var/lib/rkhunter: OK

Finished removing files. Please double-check.

First run

Before running it, we'll perform an update using the following commands (see exactly what they mean: man rkhunter):

rkhunter —update
rkhunter --propupd
#scanning, optionally with the --sk option (skip keypress)
rkhunter -c

It's worth mentioning the possibility of extensive scanner configuration, usually located in /etc/rkhunter.conf or /usr/local/etc/rkhunter.conf

I don't intend to go into detail about the configuration - every option in the rkhunter.conf file is described quite well. A simple example is the warning about the possibility of remote ssh login to the root account. If we're aware of the risk and this warning annoys us, just change ALLOW_SSH_ROOT_USER=no to ALLOW_SSH_ROOT_USER=yes in the configuration file.

#ALLOW_SSH_ROOT_USER=no
Performing system configuration file checks
   Checking for SSH configuration file                      [ Found ]
   Checking if SSH root access is allowed                   [ Warning ]
   Checking if SSH protocol v1 is allowed                   [ Not allowed ]

#ALLOW_SSH_ROOT_USER=yes
Performing system configuration file checks
   Checking for SSH configuration file                      [ Found ]
   Checking if SSH root access is allowed                   [ Allowed ]
   Checking if SSH protocol v1 is allowed                   [ Not allowed ]

Periodic system scanning

Ensuring an appropriate level of security requires systematic action from us. Just as we should keep the system updated, we should also scan it. Rkhunter's creators have built in several options useful for periodic scanning. It's best to use cron, remembering to provide full paths. In this case we check: whereis rkhunter and whereis mail. The script will run daily; an installed smtp server is required.
We create the file: /etc/cron.daily/rkhunter.sh, granting permissions: chmod 755 etc/cron.daily/rkhunter.sh

#!/bin/sh
(
/usr/local/bin/rkhunter --versioncheck
/usr/local/bin/rkhunter --update
/usr/local/bin/rkhunter --cronjob --report-warnings-only
) 2>&1 | /usr/bin/mail -s "RKhunter Raport" our_login@domain.com

Rkhunter and OpenVZ

I haven't had the chance to test the scanner on other types of virtualization, but on OpenVZ Rkhunter can, colloquially speaking, "spray warnings". In short, OpenVZ is not full virtualization (among other things, containers share the kernel). An error we might encounter: Warning: The kernel modules directory '/lib/modules' is missing or empty. To eliminate the warning, we edit the configuration as follows: /etc/rkhunter.conf:

DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps"
#let's add to the string: os_specific
DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps os_specific"

Rkhunter - false alarms

As the title says - they happen. One of the more common ones is detecting: Xzibit Rootkit, if we have the hdparm package installed. From my experience, rkhunter will definitely alert us when installed from Debian 6's official repositories, though Xzibit Rootkit can "pop up" on other distributions too. The bug definitely doesn't occur from Rkhunter 1.4.0 onwards. There are a few solutions: we can ignore it, uninstall hdparm (a silly solution), or use rkhunter's whitelist functionality. In the configuration file we find RTKT_FILE_WHITELIST and enter, one by one, the paths that Rkhunter falsely alarmed about. For example:

RTKT_FILE_WHITELIST="/etc/init.d/hdparm  /etc/init.d/.depend.boot"

Of course we must be sure before adding something to the whitelist.

Linux Administration