rkhunter

{{Short description|Unix-based computer security tool}}

{{lowercase|title=rkhunter}}

{{Primary sources|date=May 2023}}

{{Infobox software

| name = rkhunter

| screenshot = Image:rkhunter on Mac OS X.png

| caption = rkhunter on Mac OS X

| latest_release_version = 1.4.6

| latest_release_date = {{release date and age|2018|02|20|df=yes}}

| released = {{Start date and age|2006}}

| operating_system = Unix-like

| programming language = Bourne shell, Perl

| genre = rootkit detector

| license = GNU General Public License

| website = {{URL|https://sourceforge.net/projects/rkhunter/}}

}}

rkhunter (Rootkit Hunter) is a Unix-based tool that scans for rootkits, backdoors and possible local exploits.{{Cite web |date=October 29, 2018 |title=A way to detect the rootkits and exploits in CentOS/RHEL |url=https://medium.com/logistimo-engineering-blog/a-way-to-detect-the-rootkits-and-exploits-in-centos-rhel-5b125a8d6a25 |access-date=2024-07-04 |website=medium.com}} It does this by comparing SHA-1 hashes of important files with known good ones in online databases, searching for default directories (of rootkits), wrong permissions, hidden files, suspicious strings in kernel modules, and special tests for Linux and FreeBSD. rkhunter is notable due to its inclusion in popular operating systems (Fedora,{{Cite web|url=https://apps.fedoraproject.org/packages/s/rkhunter|title=Fedora Packages Search|website=apps.fedoraproject.org}} Debian,{{Cite web|url=https://packages.debian.org/sid/rkhunter|title=Debian -- Details of package rkhunter in sid|website=packages.debian.org}} etc.)

The tool has been written in Bourne shell, to allow for portability. It can run on almost all UNIX-derived systems.