Rkhunter

Last updated
rkhunter
Initial release2006;17 years ago (2006)
Stable release
1.4.6 / 20 February 2018;5 years ago (2018-02-20)
Repository
Written in Bourne shell, Perl
Operating system Unix-like
Type rootkit detector
License GNU General Public License
Website sourceforge.net/projects/rkhunter/

rkhunter (Rootkit Hunter) is a Unix-based tool that scans for rootkits, backdoors and possible local exploits. It does this by comparing SHA-1 hashes of important files with known good ones in online databases, searching for default directories (of rootkits), wrong permissions, hidden files, suspicious strings in kernel modules, and special tests for Linux and FreeBSD. rkhunter is notable due to its inclusion in popular operating systems (Fedora, [1] Debian, [2] etc.)

Contents

The tool has been written in Bourne shell, to allow for portability. It can run on almost all UNIX-derived systems.

Development

In 2003, developer Michael Boelen released the version of Rootkit Hunter. After several years of development, early 2006, he agreed to hand over development to a development team. Since that time eight people have been working to set up the project properly and work towards the much-needed maintenance release. The project has since been moved to SourceForge.

See also

Related Research Articles

<span class="mw-page-title-main">GNU</span> Free software collection

GNU is an extensive collection of free software, which can be used as an operating system or can be used in parts with other operating systems. The use of the completed GNU tools led to the family of operating systems popularly known as Linux. Most of GNU is licensed under the GNU Project's own General Public License (GPL).

<span class="mw-page-title-main">Linux distribution</span> Operating system based on the Linux kernel

A Linux distribution is an operating system made from a software collection that includes the Linux kernel, and often a package management system. Linux users usually obtain their operating system by downloading one of the Linux distributions, which are available for a wide variety of systems ranging from embedded devices and personal computers to powerful supercomputers.

<span class="mw-page-title-main">APT (software)</span> Free software package management system

Advanced package tool, or APT, is a free-software user interface that works with core libraries to handle the installation and removal of software on Debian, and Debian-based Linux distributions. APT simplifies the process of managing software on Unix-like computer systems by automating the retrieval, configuration and installation of software packages, either from precompiled files or by compiling source code.

dpkg is the software at the base of the package management system in the free operating system Debian and its numerous derivatives. dpkg is used to install, remove, and provide information about .deb packages.

<span class="mw-page-title-main">GNU Project</span> Free software project

The GNU Project is a free software, mass collaboration project announced by Richard Stallman on September 27, 1983. Its goal is to give computer users freedom and control in their use of their computers and computing devices by collaboratively developing and publishing software that gives everyone the rights to freely run the software, copy and distribute it, study it, and modify it. GNU software grants these rights in its license.

Info-ZIP is a set of open-source software to handle ZIP archives. It has been in circulation since 1989. It consists of 4 separately-installable packages: the Zip and UnZip command-line utilities; and WiZ and MacZip, which are graphical user interfaces for archiving programs in Microsoft Windows and classic Mac OS, respectively.

<span class="mw-page-title-main">Ion (window manager)</span>

In Unix computing, Ion is a tiling and tabbing window manager for the X Window System. It is designed such that it is possible to manage windows using only a keyboard, without needing a mouse. It is the successor of PWM and is written by the same author, Tuomo Valkonen. Since the first release of Ion in the summer 2000, similar alternative window management ideas have begun to show in other new window managers: Larswm, ratpoison, StumpWM, wmii, xmonad and dwm.

<span class="mw-page-title-main">Security-focused operating system</span> Operating systems, that are focused on anonymous, privacy and security.

This is a list of operating systems specifically focused on security. Operating systems for general-purpose usage may be secure without having a specific focus on security.

Technical variations of Linux distributions include support for different hardware devices and systems or software package configurations. Organizational differences may be motivated by historical reasons. Other criteria include security, including how quickly security upgrades are available; ease of package management; and number of packages available.

<span class="mw-page-title-main">Jigdo</span> Software

Jigdo is a utility typically used for downloading to piece together a large file, most commonly an optical disk image such as a CD, DVD or Blu-ray Disc (BD) image, from many smaller individual constituent files. The constituent files may be local and/or retrieved from one or more mirror sites. Jigdo's features are similar to BitTorrent, but unlike BitTorrent, Jigdo uses a client-server model, not peer-to-peer.

cdrtools is a collection of independent projects of free software/open source computer programs.

<span class="mw-page-title-main">PulseAudio</span> Sound server for Unix-like operating systems

PulseAudio is a network-capable sound server program distributed via the freedesktop.org project. It runs mainly on Linux, various BSD distributions such as FreeBSD and OpenBSD, macOS, as well as Illumos distributions and the Solaris operating system. It serves as a middleware inbetween applications and hardware and handles raw PCM audio streams.

<span class="mw-page-title-main">Linux</span> Family of Unix-like operating systems

Linux is a family of open-source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically packaged as a Linux distribution, which includes the kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name "GNU/Linux" to emphasize the importance of GNU software, causing some controversy.

Lynis is an extensible security audit tool for computer systems running Linux, FreeBSD, macOS, OpenBSD, Solaris, and other Unix derivatives. It assists system administrators and security professionals with scanning a system and its security defenses, with the final goal being system hardening.

<span class="mw-page-title-main">RPM Package Manager</span> Package management system

RPM Package Manager (RPM) is a free and open-source package management system. The name RPM refers to the .rpm file format and the package manager program itself. RPM was intended primarily for Linux distributions; the file format is the baseline package format of the Linux Standard Base.

XZ Utils is a set of free software command-line lossless data compressors, including the programs lzma and xz, for Unix-like operating systems and, from version 5.0 onwards, Microsoft Windows. For compression/decompression the Lempel–Ziv–Markov chain algorithm (LZMA) is used. XZ Utils started as a Unix port of Igor Pavlov's LZMA-SDK that has been adapted to fit seamlessly into Unix environments and their usual structure and behavior.

<span class="mw-page-title-main">Linux-libre</span> Version of the Linux kernel without proprietary code

Linux-libre is a modified version of the Linux kernel that contains no binary blobs, obfuscated code, or code released under proprietary licenses. In the Linux kernel, they are mostly used for proprietary firmware images. While generally redistributable, binary blobs do not give the user the freedom to audit, modify, or, consequently, redistribute their modified versions. The GNU Project keeps Linux-libre in synchronization with the mainline Linux kernel.

lzip Data compression utility

lzip is a free, command-line tool for the compression of data; it employs the Lempel–Ziv–Markov chain algorithm (LZMA) with a user interface that is familiar to users of usual Unix compression tools, such as gzip and bzip2.

<span class="mw-page-title-main">Newsbeuter</span> News aggregator for text terminals

Newsbeuter was a text-based news aggregator for Unix-like systems. It was originally written by Andreas Krennmair in 2007 and released under the MIT License. The program is aimed at power users and strives to be "the mutt of rss feed readers." It supports the major feed formats including RSS and Atom and can import and export subscription lists in the OPML format. Newsbeuter (podbeuter) also supports podcasting and synchronization. As of 2017, the project is no longer maintained; the original developers advise users to switch to Newsboat, an actively maintained fork of Newsbeuter.

References

  1. "Fedora Packages Search". apps.fedoraproject.org.
  2. "Debian -- Details of package rkhunter in sid". packages.debian.org.