How to Check for Rootkits on Dedicated Server

In this post, you will be taught How to Check for Rootkits on Dedicated Server. Among the various malware that attack individual systems and infrastructures, Rootkits are the most dangerous. Because in most cases they are hard to identify. If they manage to reach the core of the operating system or the middleware of infrastructure components such as CPU or BIOS, they may remain on the system forever.

Prerequisites:

– A Dedicated Server: We suggest that you buy a USA Dedicated Server from the NeuronVM website.

– Admin access to the dedicated server

– Knowledge of the server’s operating system

– Backup and recovery plan

How to Install Rkhunter on a Dedicated Server

In this section, we want to teach you about Checking for Rootkits on a Dedicated Server. 

To install the Rootkit software, you must utilize SSH on your server. After entering the dedicated server environment, you must follow the installation steps as follows.

To determine the installation location of Rkhunter, it is necessary to run the following command:

cd installation-directory/

By running the following command, you can now install Rkhunter:

wget http://sourceforge.net/projects/rkhunter/files/rkhunter/1.3.6/rkhunter-1.3.6.tar.gz/download

After downloading the file, it is necessary to decompress it using the following command:

tar zxvf rkhunter-1.3.6.tar.gz

Visit the Rkhunter directory:

cd rkhunter-1.3.2/

Finally, you can install Rkhunter with the help of the following command:

sh installer.sh --layout default --install

Checking for Rootkits on Dedicated Server

In the previous section, you learned how to install Rkhunter. After Rkhunter is successfully installed, you can view the command guide:

rkhunter --help

You can see an example command below:

rkhunter -c

The key takeaway is that chkrootkit is a tool used to detect symptoms of Rootkits. So you need to install it.

Firstly, you need to reference the installation directory of chkrootkit:

cd installation directory

Then you need to download chkrootkit:

wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz

Use the following command to extract chkrootkit:

tar zxvf chkrootkit.tar.gz

Go to the chkrootkit directory:

cd chkrootkit.tar.gz

Finally, run the following command:

make sense

Now, you can run chkrootkit:

./chkrootkit

For example, you can see a lot of data:

./chkrootkit -x |more

Conclusion

In this post, we taught you How to Check for Rootkits on Dedicated Server. The best way to identify and remove Rootkit is to continuously manually monitor irregular computer activities and monitor when files are stored on storage media at different time intervals. To protect themselves from Rootkits, users and especially organizations should install software patches, keep the operating system up-to-date, and avoid downloading suspicious files. We suggest that you read the article How to Install and Configure Antivirus on Linux Dedicated Server.