How to Scan for Rootkits on a Linux Server

When it comes to keeping your Linux server safe, rootkits are a major concern.

They are sneaky malware that can infect your Linux server without being noticed, making them a nightmare for server administrators.

Here is how to scan a Linux server for rootkits, and how to read what comes back.

_I assume you’re working on a properly set-up Ubuntu server. If not, check out my guide on preparing Ubuntu servers _ to get started.

What are Rootkits?

Rootkits are nasty pieces of malware that can deeply hide in your server, making it sometimes impossible to detect them.

Once a rootkit is on your server, it can do bad things like taking control, stealing important information, and letting hackers in.

Rootkits could replace commands like ls or ps with their own infected versions that work normally without you noticing.

They can infect any operating system, including Linux.

Key Considerations

Rootkits can only be planted after gaining administrative access to the server.

That’s why it’s crucial to prevent bad actors from gaining access to your server in the first place and planting malware.

Following essential security measures such as adding a non-root user and disabling root user access, implementing a firewall, securing SSH, and more could prevent rootkits from being installed on your server without the need for detection software.

Now, the last crucial point is that there is no software that is truly effective at detecting all rootkits. Rootkit Hunter is a good option but cannot detect every type of them.

Installing Rootkit Hunter

To install Rootkit Hunter, use the following command:

sudo apt install rkhunter

Once it is installed, the first thing to do is to run this command:

sudo rkhunter --propupd

This command is used to update the local database file with the current properties of system files.

Then we need to update the rootkit signatures but before doing this we need to adjust three things in its main configuration file.

Open the /etc/rkhunter.conf file and locate these three variables:

UPDATE_MIRRORS
MIRRORS_MODE
WEB_CMD

Change their values to look like this:

UPDATE_MIRRORS=1
MIRRORS_MODE=0
WEB_CMD=""

Now, use the following command to update the rootkit signatures:

sudo rkhunter --update

And that’s it for installing Rootkit Hunter.

Running a Scan

After successfully installing and updating Rootkit Hunter, it is time for a scan.

Use the following command to scan for rootkits:

sudo rkhunter -c

The scan will take some time and will consume server resources, so ensure you have sufficient resources available.

When running a scan using only the -c option, Rootkit Hunter will continue to prompt you to press the ENTER key to proceed with scanning.

Use the following command instead:

sudo rkhunter -c --cronjob --rwo

The --cronjob option will make the program run as a cron job, causing it to run the entire scan without asking you to press the ENTER key.

The --rwo option will instruct the program to only log warnings instead of logging everything.

You can also use the --sk option to prevent the program from prompting you to press the ENTER key.

Conclusion and Final Thoughts

You can check whether something is hiding on your server now, and you know what a false positive looks like before it scares you.