Teadmistebaas

Rootkits are malicious tools designed to hide their presence while giving an attacker persistent access to your server. Regular scanning with dedicated tools is a simple way to catch compromises early, even on a well-secured VPS.

Prerequisites

• Ubuntu or Debian VPS
• Root or sudo access

Step 1 — Install rkhunter

sudo apt update
sudo apt install rkhunter -y

Step 2 — Update Its Signature Database

sudo rkhunter --update
sudo rkhunter --propupd

--propupd creates a baseline snapshot of file properties, used to detect unexpected changes later.

Step 3 — Run a Full Scan

sudo rkhunter --check

Press Enter to step through each check, or add --sk (skip keypress) to run unattended:

sudo rkhunter --check --sk

Step 4 — Review the Report

sudo cat /var/log/rkhunter.log

Look for lines marked Warning. Many warnings on a fresh install are false positives (missing optional packages); investigate each one before assuming compromise.

Step 5 — Install and Run chkrootkit as a Second Opinion

sudo apt install chkrootkit -y
sudo chkrootkit

Running two independent scanners reduces the chance of missing something one tool doesn't detect.

Step 6 — Schedule Regular Scans

sudo crontab -e

Add a weekly scan with email alerting (requires mail configured):

0 3 * * 0 /usr/bin/rkhunter --check --sk --cronjob

If a Rootkit Is Confirmed

1. Isolate the server — disconnect it from production traffic if possible.
2. Do not trust the compromised system's own tools to fully verify or clean itself.
3. The safest remediation is usually to redeploy from a clean image/snapshot and restore data from a known-good backup, rather than attempting in-place removal.
4. Rotate all credentials and SSH keys used on that server.

Common Errors

Warnings about "hidden" files/ports that aren't actually malicious — common right after installing new software; re-run --propupd after intentional system changes to reset the baseline.

Best Practices

• Run --propupd after any legitimate system change to avoid alert fatigue
• Keep signature databases updated: rkhunter --update
• Combine rootkit scans with Fail2Ban, UFW, and regular OS updates

FAQ

Can rkhunter guarantee my server is clean?
No scanner offers a 100% guarantee against sophisticated rootkits; layered security (firewall, minimal exposed services, timely patching) matters more than any single tool.

How often should I scan?
Weekly is a reasonable baseline for most VPS workloads; increase frequency for internet-facing production servers.

Continue Reading

• VPS Security Checklist for Beginners
• How to Monitor Auth Logs and Detect Intrusion Attempts
• How to Set Up Automated VPS Backups

Browse more articles in Server Security & Hardening.