What is Rootkit Hunter ?

Rootkit Hunter also known as rkhunter may be a scanning tool. It helps you to scan out several exploits like backdoors, common exploits like – E-mail injection, Buffer overflows, format string bugs, and rootkits wherever the name originates from. Rkhunter is a UNIX operating system based tool. The approach of working, for rkhunter goes like that it compares SHA-1 hashes for vital files with the known sensible files in an online database. It searches for hidden files, uncertain strings in kernel modules, default directories for rootkits, Optional scan at intervals plain text and binary files. It also performs special tests for FreeBSD and Linux operating system. By playing these tasks, Rootkit Hunter ensures that your system is about 99% free from several kind of nasty tools.

Rootkit Hunter supports most of the Linux operating system distributions like CentOS, Fedora, Ubuntu and Redhat. The BSD distributions that start from BSD 4 to BSD 8 all are supported by Rootkit Hunter. Current version of BSD that is supported by rkhunter is NetBSD.

Rootkit Hunter is tested on following operating systems:

1. Macintosh OS
2. Red Hat Linux
3. Red Hat Enterprise Linux
4. Conectiva Linux
5. Aurora Linux
6. Yellow Dog Linux
7. Solaris (SunOS)
8. Fedora Core

Except the above systems, rkhunter is confirmed to work on:

– VectorLinux SOHO 3.2 / 4.0
– PCLinuxOS
– DaNix (Debian clone)
– Virtuozzo (VPS)

As per the needs, it only required 2 things; first, one is BourneAgain Shell (BASH) a free software Unix system Shell completely for GNU Project. Second thing, is that an Operating System Compatible with rkhunter. In 2006 initiator and developer of Rootkit Hunter Michael Boelen agreed at hand over the development. As from that point, the development is between eight individuals. Tbhey have been operating to line up the Project properly and working towards the maintenance release. The Project is currently moved to SourceForge.

Types of RootKit it works on are as follows:
– Application level
– Kernel Level
– Hypervisor level
– Library Level
– Hardware/Firmware level