Rkhunter

Last updated
rkhunter
Initial release2006;19 years ago (2006)
Stable release
1.4.6 / 20 February 2018;6 years ago (2018-02-20)
Repository
Written in Bourne shell, Perl
Operating system Unix-like
Type rootkit detector
License GNU General Public License
Website sourceforge.net/projects/rkhunter/

rkhunter (Rootkit Hunter) is a Unix-based tool that scans for rootkits, backdoors and possible local exploits. [1] It does this by comparing SHA-1 hashes of important files with known good ones in online databases, searching for default directories (of rootkits), wrong permissions, hidden files, suspicious strings in kernel modules, and special tests for Linux and FreeBSD. rkhunter is notable due to its inclusion in popular operating systems (Fedora, [2] Debian, [3] etc.)

Contents

The tool has been written in Bourne shell, to allow for portability. It can run on almost all UNIX-derived systems.

Development

In 2003, developer Michael Boelen released the version of Rootkit Hunter. After several years of development, early 2006, he agreed to hand over development to a development team. Since that time eight people have been working to set up the project properly and work towards the much-needed maintenance release. The project has since been moved to SourceForge.

See also

Related Research Articles

<span class="mw-page-title-main">GNU</span> Free software collection

GNU is an extensive collection of free software, which can be used as an operating system or can be used in parts with other operating systems. The use of the completed GNU tools led to the family of operating systems popularly known as Linux. Most of GNU is licensed under the GNU Project's own General Public License (GPL).

<span class="mw-page-title-main">Linux distribution</span> Operating system based on the Linux kernel

A Linux distribution is an operating system that includes the Linux kernel for its kernel functionality. Although the name does not imply product distribution per se, a distro, if distributed on its own, is often obtained via a website intended specifically for the purpose. Distros have been designed for a wide variety of systems ranging from personal computers to servers and from embedded devices to supercomputers.

<span class="mw-page-title-main">APT (software)</span> Free software package management system

Advanced Package Tool (APT) is a free-software user interface that works with core libraries to handle the installation and removal of software on Debian and Debian-based Linux distributions. APT simplifies the process of managing software on Unix-like computer systems by automating the retrieval, configuration and installation of software packages, either from precompiled files or by compiling source code.

dpkg is the software at the base of the package management system in the free operating system Debian and its numerous derivatives. dpkg is used to install, remove, and provide information about .deb packages.

<span class="mw-page-title-main">GNU Project</span> Free software project

The GNU Project is a free software, mass collaboration project announced by Richard Stallman on September 27, 1983. Its goal is to give computer users freedom and control in their use of their computers and computing devices by collaboratively developing and publishing software that gives everyone the rights to freely run the software, copy and distribute it, study it, and modify it. GNU software grants these rights in its license.

Info-ZIP is a set of open-source software to handle ZIP archives. It has been in circulation since 1989. It consists of 4 separately-installable packages: the Zip and UnZip command-line utilities; and WiZ and MacZip, which are graphical user interfaces for archiving programs in Microsoft Windows and classic Mac OS, respectively.

<span class="mw-page-title-main">Ion (window manager)</span> Tiling and tabbing window manager

In Unix computing, Ion is a tiling and tabbing window manager for the X Window System. It is designed such that it is possible to manage windows using only a keyboard, without needing a mouse. It is the successor of PWM and is written by the same author, Tuomo Valkonen. Since the first release of Ion in the summer 2000, similar alternative window management ideas have begun to show in other new window managers: Larswm, ratpoison, StumpWM, wmii, xmonad and dwm.

Technical variations of Linux distributions include support for different hardware devices and systems or software package configurations. Organizational differences may be motivated by historical reasons. Other criteria include security, including how quickly security upgrades are available; ease of package management; and number of packages available.

<span class="mw-page-title-main">Jigdo</span> Software

Jigdo is a utility typically used for downloading to piece together a large file, most commonly an optical disk image such as a CD, DVD or Blu-ray Disc (BD) image, from many smaller individual constituent files. The constituent files may be local and/or retrieved from one or more mirror sites. Jigdo's features are similar to BitTorrent, but unlike BitTorrent, Jigdo uses a client-server model, not peer-to-peer.

chkrootkit Software

Chkrootkit (Check Rootkit) is a widely used Unix-based utility designed to aid system administrators in examining their systems for rootkits. Operating as a shell script, it leverages common Unix/Linux tools such as the strings and grep command. The primary purpose is to scan core system programs for identifying signatures and to compare data obtained from traversal the /proc with the output derived from the ps (process status) command, aiming to identify inconsistencies. It offers flexibility in execution, allowing it to function from a rescue disc, often a live CD, and provides an optional alternative directory for executing its commands. These approaches enhance chkrootkit's reliance on the commands it employs.

cdrtools is a collection of independent projects of free software/open source computer programs for CD and DVD authoring.

<span class="mw-page-title-main">PulseAudio</span> Sound server for Unix-like operating systems

PulseAudio is a network-capable sound server program distributed via the freedesktop.org project. It runs mainly on Linux, including Windows Subsystem for Linux on Microsoft Windows and Termux on Android; various BSD distributions such as FreeBSD, OpenBSD, and macOS; as well as Illumos distributions and the Solaris operating system. It serves as a middleware in between applications and hardware and handles raw PCM audio streams.

Lynis is an extensible security audit tool for computer systems running Linux, FreeBSD, macOS, OpenBSD, Solaris, and other Unix derivatives. It assists system administrators and security professionals with scanning a system and its security defenses, with the final goal being system hardening.

<span class="mw-page-title-main">RPM Package Manager</span> Package management system

RPM Package Manager (RPM) is a free and open-source package management system. The name RPM refers to the .rpm file format and the package manager program itself. RPM was intended primarily for Linux distributions; the file format is the baseline package format of the Linux Standard Base.

XZ Utils is a set of free software command-line lossless data compressors, including the programs lzma and xz, for Unix-like operating systems and, from version 5.0 onwards, Microsoft Windows. For compression/decompression the Lempel–Ziv–Markov chain algorithm (LZMA) is used. XZ Utils started as a Unix port of Igor Pavlov's LZMA-SDK that has been adapted to fit seamlessly into Unix environments and their usual structure and behavior.

<span class="mw-page-title-main">Linux-libre</span> Version of the Linux kernel without proprietary code

According to the Free Software Foundation Latin America, Linux-libre is a modified version of the Linux kernel that contains no binary blobs, obfuscated code, or code released under proprietary licenses. In the Linux kernel, those types of code are mostly used for proprietary firmware images. While generally redistributable, they do not give the user the freedom to audit, modify, or, consequently, redistribute their modified versions. The GNU Project keeps Linux-libre in synchronization with the mainline Linux kernel.

lzip Data compression utility

lzip is a free, command-line tool for the compression of data; it employs the Lempel–Ziv–Markov chain algorithm (LZMA) with a user interface that is familiar to users of usual Unix compression tools, such as gzip and bzip2.

<span class="mw-page-title-main">Newsbeuter</span> News aggregator for text terminals

Newsbeuter was a text-based news aggregator for Unix-like systems. It was originally written by Andreas Krennmair in 2007 and released under the MIT License. The program is aimed at power users and strives to be "the mutt of rss feed readers." It supports the major feed formats including RSS and Atom and can import and export subscription lists in the OPML format. Newsbeuter (podbeuter) also supports podcasting and synchronization. As of 2017, the project is no longer maintained; the original developers advise users to switch to Newsboat, an actively maintained fork of Newsbeuter.

<span class="mw-page-title-main">Borg (backup software)</span> Deduplicating backup program

Borg is deduplicating backup software for various Unix-like operating systems. Borg is notably included in the Debian, Fedora, and Arch repositories.

Comparison of host-based intrusion detection system components and systems.

References

  1. "A way to detect the rootkits and exploits in CentOS/RHEL". medium.com. October 29, 2018. Retrieved 2024-07-04.
  2. "Fedora Packages Search". apps.fedoraproject.org.
  3. "Debian -- Details of package rkhunter in sid". packages.debian.org.