Rkhunter (Rootkit Hunter) is a command-line tool that can be used to scan for rootkits, backdoors, and other malicious software on your Linux system. It is a powerful tool that can help you to detect and remove rootkits and other malicious software that may have been installed on your system without your knowledge.

In this article, we will show you how to install Rkhunter on Debian 10 (also known as “Buster”). We will be using the command line for this tutorial, so you will need to have a basic understanding of how to use the Linux command line.

Before we begin, there are a few prerequisites that you will need to have in place in order to install Rkhunter on your system:

1. A server running Debian 10
2. A user account with sudo privileges
3. The apt package manager installed

Once you have these prerequisites in place, you can proceed with the installation.

• Update your system

Before you begin the installation, it is always a good idea to update your system to ensure that you have the latest security updates and bug fixes. To do this, log in to your server and run the following command:

sudo apt update
sudo apt upgrade

This will update the package list on your system and then upgrade any outdated packages to their latest versions.

• Install the necessary packages

Rkhunter requires a number of dependencies in order to run, including the Perl interpreter and the GNU C compiler. To install these dependencies, run the following command:

sudo apt install perl build-essential

This will install the Perl interpreter and the GNU C compiler.

• Download and extract Rkhunter

Next, you will need to download the latest version of Rkhunter from their website. At the time of writing, the latest version is Rkhunter 1.4.8. To download it, run the following command:

wget <https://downloads.sourceforge.net/project/rkhunter/rkhunter/1.4.8/rkhunter-1.4.8.tar.gz>

This will download the Rkhunter package to your server. Once the download is complete, extract the package using the following command:

tar xvzf rkhunter-1.4.8.tar.gz

This will extract the Rkhunter files into a directory named “rkhunter-1.4.8”.

• Install Rkhunter

To install Rkhunter, navigate to the directory where you extracted the files and run the following commands:

cd rkhunter-1.4.8
sudo ./installer.sh --install

This will install Rkhunter on your system.

• Configure Rkhunter

Before you can use Rkhunter, you will need to configure it with your email address and other settings. To do this, open the Rkhunter configuration file using the following command:

sudo nano /etc/rkhunter.conf

In the configuration file, update the following settings:

MAIL-ON-WARNING=root
MAIL_CMD=mail -s "[rkhunter] Warnings found for ${HOST_NAME}"

Replace “root” with your own email address. This will cause Rkhunter to send email notifications to your email address if it finds any warnings or errors during a scan.

Save the file and exit the text editor.

• Run Rkhunter

To run Rkhunter, use the following command:

sudo rkhunter --check

This will run a scan of your system and check for any rootkits or other malicious software. The scan may take a few minutes to complete, depending on the size of your system.

Once the scan is complete, Rkhunter will print the results to the terminal. If it finds any warnings or errors, it will also send an email notification to the address you specified in the configuration file.

Conclusion

In this article, we showed you how to install Rkhunter on Debian 10. We covered all of the necessary steps, including installing dependencies, downloading and extracting the Rkhunter package, and configuring Rkhunter. With Rkhunter installed and configured, you can now use it to scan your system for rootkits and other malicious software.