Mastering Linux Security and Hardening

Scanning for rootkits

To run your scan, use the -c option. (That's -c for check.)  Be patient, because it will take a while:

sudo rkhunter -c

When you run the scan in this manner, Rootkit Hunter will periodically stop and ask you to hit the Enter key to continue. When the scan completes, you'll find an rkhunter.log file in the /var/log directory.

To have Rootkit Hunter automatically run as a cron job, you'll want to use the --cronjob option, which will cause the program to run all the way through without prompting you to keep hitting the Enter key. You might also want to use the --rwo option, which will cause the program to only report warnings, instead of also reporting on everything that's good.  From the command line, the command would ...