rkhunter
Sign in to saveAlso known as Rootkit Hunter
rkhunter (Rootkit Hunter) is a Unix-based tool that scans for rootkits, backdoors and possible local exploits. It does this by comparing SHA-1 hashes of important files with known good ones in online databases, searching for default directories (of rootkits), wrong permissions, hidden files, suspicious strings in kernel modules, and special tests for Linux and FreeBSD. rkhunter is notable due to its inclusion in popular operating systems (Fedora, Debian, etc.)
~2 min read
Encyclopedic overview
4 sectionsContents
- Development
- See also
- References
- External links
rkhunter (Rootkit Hunter) is a Unix-based tool that scans for rootkits, backdoors and possible local exploits. It does this by comparing SHA-1 hashes of important files with known good ones in online databases, searching for default directories (of rootkits), wrong permissions, hidden files, suspicious strings in kernel modules, and special tests for Linux and FreeBSD. rkhunter is notable due to its inclusion in popular operating systems (Fedora, Debian, etc.)
The tool has been written in Bourne shell, to allow for portability. It can run on almost all UNIX-derived systems.
Excerpted from Wikipedia’s “rkhunter” article, available under the CC BY-SA 4.0 licence.