🛡️ Install rkhunter (Rootkit Hunter) – cPanel/WHM + CloudLinux Edition

By /

Installing and configuring Rootkit Hunter (rkhunter) on a cPanel/WHM server running CloudLinux — including best practices for integration and automation:

Rootkit Hunter (rkhunter) is a vital security scanner for Linux servers, especially those running web hosting environments like cPanel/WHM with CloudLinux. It helps detect:

  • Rootkits
  • Backdoors
  • Local exploits
  • Malicious hidden files
  • Tampered system binaries

✅ Benefits for cPanel/CloudLinux Environments

  • Scans core system binaries and detects common server compromises
  • Works well alongside Imunify360 and CSF/LFD for layered security
  • Detects changes outside of CageFS chroot environments
  • Sends alerts when suspicious activity is detected at the OS level

🔧 Installation

Option 1 – Install via YUM (Preferred for CloudLinux/CentOS/AlmaLinux):

yum install rkhunter -y

Option 2 – Manual Install (If newer version needed):

cd /usr/local/src
wget http://scripts.hostxnow.com/rkhunter-1.4.0.tar.gz
tar -xzf rkhunter-1.4.0.tar.gz
cd rkhunter-1.4.0
./installer.sh --install

🔄 Update rkhunter

Immediately update its database after installation:

rkhunter --update

Then update the system file properties baseline:

rkhunter --propupd

If you get warnings about files (like WHM/cPanel binaries), they can be safely excluded using:

nano /etc/rkhunter.conf

Look for and edit:

ALLOWHIDDENDIR=/usr/local/cpanel
ALLOWHIDDENFILE=/usr/local/cpanel/whostmgr/docroot/.cpanel/caches

🔍 Manual Scans

Run a full check (interactive):

rkhunter -c

Skip interactive prompts (recommended for automation):

rkhunter -c -sk

📧 Weekly Email Reports with Cron

Create a weekly cronjob to scan and email the results:

nano /etc/cron.weekly/rkhunter.sh

Paste:

#!/bin/sh
(
  /usr/bin/rkhunter --versioncheck
  /usr/bin/rkhunter --update
  /usr/bin/rkhunter --cronjob --summary
) | /bin/mail -s "rkhunter Report - $(hostname)" [email protected]

Make it executable:

chmod 750 /etc/cron.weekly/rkhunter.sh

Make sure mailx is installed and configured:

yum install mailx -y

Replace [email protected] with your actual email.

🔄 Adjust rkhunter.conf for cPanel/CloudLinux

Open the config file:

nano /etc/rkhunter.conf

Update this if needed (especially on CloudLinux):

SCRIPTDIR=/usr/libexec/rkhunter/scripts

Add exceptions to prevent false positives:

ALLOWHIDDENDIR=/etc/apache2/logs
ALLOWHIDDENFILE=/usr/local/cpanel/3rdparty

🤝 Integration Tips with Imunify360 & CSF

  • Imunify360 and rkhunter complement each other: Imunify360 monitors active threats and file injection, while rkhunter scans OS integrity.
  • rkhunter logs are not overridden by Imunify360, so you can use both safely.
  • You can optionally integrate rkhunter logs into CSF/LFD alerts by editing:
nano /etc/csf/csf.logfiles

Add:

/var/log/rkhunter.log

Then restart CSF:

csf -r

📂 Log Location

All scan results are saved here:

/var/log/rkhunter.log

✅ Final Checklist

TaskStatus
Installed via YUM✅
Configured exceptions✅
Updated hash properties✅
Created cron job✅
Integrated with CSF/LFD✅ (Optional)
Scroll to Top