What this module does #
A rootkit is malicious software designed to sneak into your server and hide: it replaces system commands, opens backdoors and erases its own traces so you don't see it. That's exactly the problem — when it works well, you don't notice it. That's why it's worth checking the system regularly.
The rkhunter module relies on rkhunter (Rootkit Hunter) to do that work for you: it scans the system by comparing files and commands against known rootkit signatures, watches for suspicious properties (odd permissions, hidden ports, modified binaries) and summarizes the warnings for you in clear language so you know what to look at. It also maintains a baseline — a snapshot of how your files should look — and the signatures up to date, the two pieces that reliable detection depends on.
After installing the module or updating system packages, update the baseline with update-baseline. If you don't, legitimate changes (for example, an apt upgrade) will show up as warnings and you'll struggle to tell the normal from the suspicious.
Common tasks #
Pick what you want to do. Each recipe comes with the command already written — copy it, paste it and hit Copy.
1
Scan the system now
Launch a full analysis and get a summary of warnings.
Connect to your server over SSH with the ubuntu user.
Launch the scan. It takes a while: rkhunter reviews hundreds of files and commands.
$ sudo imaxe rkhunter checkCalling it from a script or want to integrate it with another tool? Add --json:
$ sudo imaxe rkhunter check --json2
View the warnings from the last scan
Go over what rkhunter flagged, in a readable format.
Show the warnings from the last check without having to scan again:
$ sudo imaxe rkhunter report3
Check the status
At a glance: installation, baseline, last scan and warnings.
A quick summary of whether rkhunter is ready, whether there's a baseline, when the last scan was, how many warnings it left and whether a scan is scheduled:
$ sudo imaxe rkhunter statusFor monitoring or scripts, ask for it in JSON:
$ sudo imaxe rkhunter status --json4
Update the baseline
Accept the current state of the files as a good reference.
Save the current properties of the files as the baseline (equivalent to rkhunter --propupd). Do this only when you trust the state of the system — for example, right after installing it or after an update you recognize:
$ sudo imaxe rkhunter update-baselinecheck starts from this new reference snapshot.5
Update the signatures
Download the most recent rkhunter data files.
Update rkhunter's data files and signatures (equivalent to rkhunter --update) so detection knows about the most recent rootkits:
$ sudo imaxe rkhunter update-datacheck detects more recent threats. It's worth doing before an important scan.It's normal the first time or right after updating packages: rkhunter sees changes that aren't in the baseline yet. Review them with report, and if you recognize them as legitimate, accept them with update-baseline. Never update the baseline if you suspect the system is already compromised.
Synopsis #
imaxe rkhunter <subcomando> [--json]All subcommands require root privileges (use sudo) because rkhunter needs to read system files, compare binaries and write its baseline and its data. Add --json to check or status to get machine-readable output, suitable for scripting and monitoring.
Subcommands #
| Subcommand | What it does | Relevant flags |
|---|---|---|
| check | Launches a rootkit/malware scan and summarizes the warnings. | --json |
| report | Shows the warnings from the last scan in a readable form. | — |
| status | Status: installed, baseline present, last scan, warnings and scheduled scan. | --json |
| update-baseline | Accepts the current file properties as the baseline (rkhunter --propupd). | — |
| update-data | Updates rkhunter's data/signature files (rkhunter --update). | — |
Arguments and flags #
| Flag | Type | Default | Description |
|---|---|---|---|
| --json | bool | false | In check/status, emits the result as structured JSON on stdout, suitable for scripting and monitoring. |
The report, update-baseline and update-data subcommands take no flags: they run without arguments.
Files and paths #
| Path | Contents |
|---|---|
| /etc/imaxe/rkhunter.yml | Module configuration: by default, check reports only warnings (report_warnings_only). |
| /var/lib/rkhunter/db/ | File properties baseline and data/signature files that update-baseline and update-data update. |
| /var/log/rkhunter.log | Log of the last scan, from which report extracts the warnings. |
Example rkhunter.yml:
check:
report_warnings_only: trueExit codes and logs #
Each run returns a code you can check with echo $? — handy for chaining in scripts or alerting from monitoring:
Check the log of the last scan while you review:
$ sudo imaxe rkhunter report
$ sudo tail -f /var/log/rkhunter.logTroubleshooting #
| Symptom | Likely cause | Fix |
|---|---|---|
| WARN appears (code 1) after updating packages | Legitimate changes that aren't in the baseline yet. | Review with report; if you recognize them, accept them with update-baseline. |
status says "baseline: not present" | The module was just installed and there's no reference snapshot. | Run update-baseline once with the system in a trusted state. |
| Many warnings about old files or versions | rkhunter signatures and data are out of date. | Run update-data and repeat the check. |
| ERR appears (code 3) | rkhunter isn't installed or the binary isn't responding. | Check the module installation and consult /var/log/rkhunter.log. |
Stuck with the rkhunter module?
Write to us with the output of «imaxe <module> status --json» and we'll get back to you fast.