RKHunter Notes

Installation

./installer.sh --layout default --install

You can also specify --layout RPM instead and create an RPM. However,
you will need to export a value for the $RPM_BUILD_ROOT variable.
rkhunter installs itself as follows (on a 64-bit machine):

INSTALLDIR=/usr/local  
DBDIR=/var/lib/rkhunter/db  
SCRIPTDIR=/usr/local/lib64/rkhunter/scripts  
TMPDIR=/var/lib/rkhunter/tmp  
USER_FILEPROP_FILES_DIRS=/etc/rkhunter.conf

Update

[root@support rkhunter-1.3.6]# rkhunter --update  
[ Rootkit Hunter version 1.3.6 ]  
  
Checking rkhunter data files...  
  Checking file mirrors.dat                                  [ No update ]  
  Checking file programs_bad.dat                             [ No update ]  
  Checking file backdoorports.dat                            [ No update ]  
  Checking file suspscan.dat                                 [ No update ]  
  Checking file i18n/cn                                      [ No update ]  
  Checking file i18n/de                                      [ No update ]  
  Checking file i18n/en                                      [ No update ]  
  Checking file i18n/zh                                      [ No update ]  
  Checking file i18n/zh.utf8                                 [ No update ]

Configure

Edit /etc/rkhunter.conf and make sure you have the package manager set
to RPM:

PKGMGR=RPM

Now create the properties file. It is vitally important to do this
on a system you’re sure hasn’t been compromised.

rkhunter --propupd

Now scan your system:

rkhunter -c

The output is sent to /var/log/rkhunter.log.

Other stuff

In case you’re warned about scripts, files and directories which you
know are okay, you can whitelist them with SCRIPTWHITELIST,
ALLOWHIDDENFILE, and ALLOWHIDDENDIR respectively in
rkhunter.conf.

You may get warnings like these in rkhunter.log:

Warning: One or more of these files were found: backdoor, adore.o, mod_rootme.so...

This may or may not be innocuous, so it’s best to check. Use the files
below.

Quick checker script

#!/bin/bash  
    
SUSP_FILES=$(cat suspiciousfilelist)  
lsof -F n -w -n | grep '^n/' | sed -e 's/^n//' | sort | uniq | grep "$SUSP_FILES"

Full list of files

backdoor  
adore.o  
mod_rootme.so  
phide_mod.o  
lbk.ko  
vlogger.o  
cleaner.o  
cleaner  
ava  
tzava  
mod_klgr.o  
hydra  
hydra.restore  
ras2xm  
vobiscum  
sshd3  
system  
t0rnsb  
t0rns  
t0rnp  
rx4u  
rx2me  
crontab  
sshdu  
glotzer  
holber  
xhide  
xh  
emech  
psybnc  
mech  
httpd.bin  
mh  
xl  
write  
Phantasmagoria.o  
lkt.o  
nlkt.o