[[http://rkhunter.sourceforge.net/|rkhunter]] (Rootkit Hunter) scans for rootkits, backdoors and possible local exploits. It does this by comparing SHA-1 hashes of important files with known good ones in online databases, searching for default directories (of rootkits), wrong permissions, hidden files, suspicious strings in kernel modules and running special tests for Linux.

To install
<code>
sudo apt-get install rkhunter
</code>

Run this to update and populate the file properties database
<code>
sudo rkhunter --update --propupd
</code>
This has to be run after every software update or you'll get false warnings..

Also check for new versions of rkhunter with
<code>
sudo rkhunter --versioncheck
</code>

To update, you actually have to download the source from [[|here]] then extract the folder, cd into the folder and ..
<code>
sudo ./installer.sh --layout /usr --install
</code>
Note: if rkhunter is already install, you may have to manually edit the ''/etc/rkhunter.conf'' for the new version. Add
<code>
ALLOWHIDDENDIR=/etc/.java
ALLOWHIDDENDIR=/dev/.udev
ALLOWHIDDENDIR=/dev/.udevdb
ALLOWHIDDENDIR=/dev/.mdadm
ALLOWHIDDENDIR=/dev/.initramfs
</code>
and also install mailutils if you set the ''MAIL-ON_WARNING'' variable to your email account (but this might be tedious for ordinary users.. just run ''rkhunter'' manually once in a while..)

Finally to check for possible rootkits
<code>
sudo rkhunter --checkall
</code>

Check ''/var/log/rkhunter.log'' for details after the check, most easily I suppose by running
<code>
sudo gedit /var/log/rkhunter.log
</code>

You can subscribe to the [[https://lists.sourceforge.net/lists/listinfo/rkhunter-users|rkhunters mailing list]] if you keep getting a lot of suspicious stuff and need more info..

To really get into the intrusion detection game, check [[http://web.archive.org/web/20080109214340/http://www.cert.org/tech_tips/intruder_detection_checklist.html|this page]]\\

There is also an [[https://solidshellsecurity.com/tools/rkhunter-automatic-script-installer.php|automated script]] to install ''rkhunter''\\