A single‑line cron that runs rkhunter nightly and emails you only on matches

 Posted on 16 September 2026  |  4 minutes  |  670 words  |  Carla Brown

Why rkhunter Still Matters

Rootkit detection tools are the unsung heroes of a hardened Linux box.
Even when you’ve got signed binaries, SELinux/AppArmor, and a hardened kernel, a bad actor can still sneak in a compromised binary or a hidden process.
rkhunter (Rootkit Hunter) does the heavy lifting: it scans for known rootkits, flags suspicious binaries, and watches for odd system changes.
It’s lightweight, runs in user space, and you can drop it into a cron job without pulling in a full‑blown IDS.
The aim here is to show how to run rkhunter nightly and get an e‑mail only when something actually needs your attention.

Preparing the Environment

  1. Install rkhunter

    # Debian/Ubuntu
sudo apt update && sudo apt install rkhunter

# RHEL/CentOS
sudo dnf install rkhunter

# Arch
sudo pacman -S rkhunter

  2. Verify the binary

    rkhunter --version

    The output should include the commit hash from the official repo: https://github.com/rkhunter/rkhunter.

  3. Set up a dedicated mail account
    Many servers use ssmtp or msmtp to forward local mail to an external provider.
    For a quick test, install mailutils and tweak /etc/ssmtp/ssmtp.conf.
    The mail will be sent from root@yourhost to your personal address.

Configuring rkhunter

rkhunter’s configuration lives in /etc/rkhunter.conf.
The bits that matter for a nightly check:

Option Description Typical value
MAILTO Email address for alerts [email protected]
MAILFROM From address root@yourhost
RUNALL Run all checks yes
IGNORE Files to ignore /usr/local/bin/*
EXCLUDE Directories to skip /var/cache

After editing, run:

sudo rkhunter --update
sudo rkhunter --propupd

--update pulls fresh signatures; --propupd records the current state so that future scans only flag changes.

Testing the Command

Before you let cron handle it, make sure the command works:

sudo rkhunter --check --sk --quiet --logfile /tmp/rkhunter.log
  • --sk – skip the rootkit check if you’re only after file integrity.
  • --quiet – keep the console clean; the log file will have everything.
  • --logfile – write the report to a known spot.

Open /tmp/rkhunter.log and look for lines starting with FOUND:.
If there are none, your system is clean. If you see entries, note the paths and severity.

Crafting the Cron Line

A nightly job at 3 a.m. looks like this:

0 3 * * * /usr/bin/rkhunter --check --sk --quiet --logfile /var/log/rkhunter.log | /usr/bin/mail -s "rkhunter alert" you@example.com

Why pipe directly?
rkhunter spits out a lot of informational text. By piping the output to mail, you only get the payload you care about. If the log is empty, no mail is sent. If there are findings, the mail contains them.

Email Delivery Considerations

  1. Local MTA – Make sure ssmtp or msmtp is wired up. Test with:

    echo "Test" | mail -s "Test" [email protected]

  2. Spam Filters – Some providers flag automated mails. Add a custom header or use a dedicated alert address.

  3. Size Limits – Huge logs can get truncated. If that happens, send only the first part:

    /usr/bin/rkhunter --check --sk --quiet --logfile /var/log/rkhunter.log | head -n 200 | /usr/bin/mail -s "rkhunter alert" [email protected]

  4. SMTP Authentication – If you forward through an external relay, configure ssmtp.conf with AuthUser and AuthPass. Keep credentials safe with chmod 600 on the config file.

Tuning the Output

rkhunter can be chatty. Use these flags to trim the noise:

Flag Effect
--quiet Suppress progress bars
--nodatabase Skip database checks (run --update separately)
--noquiet Re‑enable progress if debugging
--skip=unpackaged Skip checks that you know are irrelevant

If you only care about rootkits, drop --sk. For a minimal report:

/usr/bin/rkhunter --check --quiet --logfile /var/log/rkhunter.log

Then send mail only if something was found:

if grep -q "FOUND:" /var/log/rkhunter.log; then
  mail -s "rkhunter alert" [email protected] < /var/log/rkhunter.log
fi

Wrap that in a tiny shell script (/usr/local/bin/rkhunter-alert.sh) and schedule it via cron:

0 3 * * * /usr/local/bin/rkhunter-alert.sh

Handling False Positives

Rootkit hunters are useful, but they’ll flag benign changes as suspicious. Common culprits:

  • Package updates – New binaries, altered permissions, or changed timestamps.
  • System upgrades – Kernel modules, init scripts, or PAM modules can change.
  • Manual tweaks – Adding or removing user‑land binaries in /usr/local/bin.

The real trick is to keep the baseline up‑to‑date. Run rkhunter --propupd after every package

linux  open-source 

See also