When we talk about Linux security, tools like curl, wget, locate, and even advanced scripting techniques such as Bash heredocs are incredibly useful for automation and system administration. But no matter how skilled you are with downloading packages, searching binaries, or writing scripts, your system’s integrity can still be compromised by something far more dangerous: a rootkit.

In this in-depth guide, I’ll walk you through how to detect and check for rootkits using two classic and battle-tested tools:

chkrootkit
rkhunter (Rootkit Hunter)

This article covers installation, configuration, interpretation of results, automation, and practical security strategies across major Linux distributions.

What Is a Rootkit?

A rootkit is a collection of malicious tools designed to hide unauthorized access or malicious processes on a system. Unlike common malware, rootkits aim to:

Gain or maintain root-level privileges
Hide files, processes, ports, or network connections
Replace system binaries (e.g., ps, netstat, ls)
Manipulate kernel modules
Evade traditional monitoring tools

Once installed, a rootkit makes intrusion detection significantly harder by modifying the very tools you rely on to inspect your system.

There are two major types:

1. Userland Rootkits

Replace or modify system binaries and libraries.

2. Kernel Rootkits

Operate at the kernel level, often using loadable kernel modules (LKMs), making them more stealthy and dangerous.

Because of this stealth nature, specialized detection tools are necessary.

Introducing Chkrootkit

Chkrootkit is a lightweight, open-source shell script that scans your Linux system for known rootkits and suspicious modifications.

It checks for:

Known rootkit signatures
Modified system binaries
Suspicious network interfaces
Hidden processes
Anomalies in /proc
Promiscuous mode network interfaces

It is fast, simple, and requires minimal configuration, making it ideal for quick audits and regular scanning.

Installing Chkrootkit

Installation varies slightly by distribution.

On Ubuntu / Debian

sudo apt update
sudo apt install chkrootkit

On Kali Linux

sudo apt install chkrootkit

On Arch Linux

sudo pacman -S chkrootkit

Running Chkrootkit

Basic usage is straightforward:

sudo chkrootkit

This command performs a full scan of the system.

You will see output similar to:

Checking `ifconfig'... not infected
Checking `login'... not infected
Checking `sshd'... not infected
Checking `rc.local'... INFECTED

Understanding Results

“not infected” → No known signature detected.
“INFECTED” → Needs investigation (not always true infection).
Some checks may produce false positives, especially on modern systems with containers or custom kernels.

Important Note on False Positives

Modern distributions often trigger warnings because:

Systemd replaces older init systems.
Container environments alter /proc.
Kernel behavior differs from older rootkit signatures.

Never panic. Always verify manually.

Advanced Chkrootkit Usage

Quiet Mode

sudo chkrootkit -q

Shows only suspicious findings.

Local Directory Mode (Offline Analysis)

sudo chkrootkit -r /mnt/suspect-system

Useful for forensic investigations on mounted drives.

Checking Promiscuous Network Interfaces

sudo chkrootkit -n

Rootkits sometimes use promiscuous interfaces to sniff traffic.

Introducing RKHunter (Rootkit Hunter)

While chkrootkit focuses heavily on signature-based scanning, RKHunter goes further.

RKHunter checks:

File hashes and integrity
Suspicious strings in kernel modules
Hidden files
Wrong permissions
Suspicious startup files
Backdoored binaries
Known rootkit signatures

It provides a more structured and integrity-focused analysis.

Installing RKHunter

Ubuntu / Debian

sudo apt install rkhunter

Arch Linux

sudo pacman -S rkhunter

Configuring RKHunter Properly

Before running scans, update the database:

sudo rkhunter --update

Then initialize file properties:

sudo rkhunter --propupd

This step is critical. It creates a clean baseline of file hashes. Run it only on a trusted system state.

Running RKHunter

sudo rkhunter --check

For a non-interactive scan:

sudo rkhunter --check --sk

To view warnings only:

sudo rkhunter --check --report-warnings-only

Interpreting RKHunter Output

RKHunter categorizes findings:

OK
Warning
Not Found
Suspicious

Warnings may include:

Changed file properties
Hidden directories
Unexpected listening ports
Modified kernel modules

Logs are stored in:

/var/log/rkhunter.log

Always read logs carefully before making assumptions.

Chkrootkit vs RKHunter: Which Should You Use?

Both tools are valuable but focus on different aspects of rootkit detection. Chkrootkit is excellent for quick signature-based scans and catching known rootkits, while RKHunter goes deeper with file integrity checks, kernel module analysis, and broader suspicious activity detection. Using both together provides a layered approach that maximizes coverage and reduces the chance of missing stealthy threats.

Best Practices for Rootkit Detection

1. Run Scans from Single-User Mode

If possible:

systemctl isolate rescue.target

Scanning while fewer services run reduces interference.

2. Scan from a Live Environment

For suspected compromise:

Boot from trusted Live USB.
Mount system drive.
Run chkrootkit with -r option.

This avoids rootkits hiding themselves in active memory.

3. Schedule Automated Scans

Cron Example

sudo crontab -e

Add:

0 3 * * * /usr/bin/rkhunter --check --sk --report-warnings-only

Runs every day at 03:00.

4. Keep Your System Updated

Most rootkits exploit:

Outdated kernels
Old OpenSSL libraries
Privilege escalation flaws

Regular updates drastically reduce risk.

5. Combine with Other Security Tools

Rootkit scanners should be part of a broader security approach:

Auditd
Fail2Ban
Log monitoring
File integrity tools
Firewall hardening
Minimal exposed services

Limitations You Must Understand

Rootkit detection tools:

Cannot detect zero-day rootkits
Rely on known signatures
May miss firmware or hypervisor-level malware
Depend on system trust (if kernel is deeply compromised)

In extreme cases, the only safe response is:

Backup essential data
Reinstall from trusted media
Rotate credentials
Audit logs

Security is about risk reduction, not absolute guarantees.

A Practical Workflow I Personally Follow

When auditing a Linux server:

Update RKHunter database.
Run rkhunter --propupd (only on clean system).
Run full RKHunter scan.
Run full chkrootkit scan.
Compare suspicious entries.
Manually inspect flagged binaries using:
- stat
- ls -la
- sha256sum
Check network sockets: ss -tulnp
Investigate unexpected users: cat /etc/passwd

Security requires methodical verification, not blind trust in tools.

When You Should Be Concerned

Immediate red flags:

Modified sshd
Suspicious listening ports
Unknown cron jobs
Hidden /dev entries
Kernel module warnings
Unexpected SUID binaries

If multiple tools flag the same component, escalate investigation.

Final Thoughts

Rootkits remain one of the most stealthy and dangerous threats in Linux environments. While Linux is inherently secure by design, it is not immune to sophisticated attacks.

Tools like chkrootkit and rkhunter provide valuable visibility into system integrity, especially when used together and combined with disciplined security practices.

If you manage Linux servers—whether VPS, cloud instances, or bare metal—you should integrate rootkit scanning into your regular maintenance routine.

Security is not a one-time task. It’s an ongoing process of verification, monitoring, and improvement. Stay vigilant.

Detecting and Checking Rootkits on Linux with Chkrootkit and RKHunter (Complete Technical Guide)