How to: Rootkit Detection With Rkhunter (WIP)
#### Why

WIP

#### How It Works

WIP

#### Goals

WIP

#### References

- http://rkhunter.sourceforge.net/
- https://www.cyberciti.biz/faq/howto-check-linux-rootkist-with-detectors-software/
- https://www.tecmint.com/install-rootkit-hunter-scan-for-rootkits-backdoors-in-linux/

#### Steps

1. Install Rkhunter.

    On Debian based systems:
    
    ``` bash
    sudo apt install rkhunter
    ```

1. Make a backup of rkhunter' defaults file:

    ``` bash
    sudo cp -p /etc/default/rkhunter /etc/default/rkhunter-COPY-$(date +"%Y%m%d%H%M%S")
    ```

1. rkhunter's configuration file is `/etc/rkhunter.conf`. Instead of making changes to it, create and use the file `/etc/rkhunter.conf.local` instead:

    ``` bash
    sudo cp -p /etc/rkhunter.conf /etc/rkhunter.conf.local
    ```
    
1. Go through the configuration file `/etc/rkhunter.conf.local` and set to your requirements. My recommendations:

    |Setting|Note|
    |--|--|
    |`UPDATE_MIRRORS=1`||
    |`MIRRORS_MODE=0`||
    |`MAIL-ON-WARNING=root`||
    |`COPY_LOG_ON_ERROR=1`|to save a copy of the log if there is an error|
    |`PKGMGR=...`|set to the appropriate value per the documentation|
    |`PHALANX2_DIRTEST=1`|read the documentation for why|
    |`WEB_CMD=""`|this is to address an issue with the Debian package that disables the ability for rkhunter to self-update.|
    |`USE_LOCKING=1`|to prevent issues with rkhunter running multiple times|
    |`SHOW_SUMMARY_WARNINGS_NUMBER=1`|to see the actual number of warnings found|

1. You want rkhunter to run every day and e-mail you the result. You can write your own script or check https://www.tecmint.com/install-rootkit-hunter-scan-for-rootkits-backdoors-in-linux/ for a sample cron script you can use.
   
    On Debian based system, rkhunter comes with cron scripts. To enable them check `/etc/default/rkhunter` or use `dpkg-reconfigure` and say `Yes` to all of the questions:
    
    ``` bash
    sudo dpkg-reconfigure rkhunter
    ```

1. After you've finished with all of the changes, make sure all the settings are valid:

    ``` bash
    sudo rkhunter -C
    ```

1. Update rkhunter and its database:

    ``` bash
    sudo rkhunter --versioncheck
    sudo rkhunter --update
    sudo rkhunter --propupd
    ```

1. If you want to do a manual scan and see the output:

    ``` bash
    sudo rkhunter --check
    ```

([Table of Contents](#table-of-contents))