Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are there any good services or ways to scan for rootkits and backdoors?

I know there are rkhunter and chkrootkit but are they even ideal anymore? They never seem updated and look more like they were good in the early 2000's

share|improve this question
Might be worth popping over to SuperUser as opposed to ServerFault. – francisswest Jun 13 '12 at 20:47
The rkhunter data (signatures) file was last updated this morning. The rkhunter engine was last updated in April. I wouldn't call that out of date... – Zoredache Jun 13 '12 at 21:11
up vote 0 down vote accepted

I don't know how often OSSEC updates their rootkit detection but I know it has the capability built in. Below is the link that shows the various checks that are performed - Overall I love the product due to it being able to do rootkit checking, integrity checking, and still being a HIDS/HIPS. You can also easily create your own rules to alert on basically anything.

Edit: As far as backdoors go, you can use the process monitoring feature - There is an example on the page that will alert you if the output of a netstat command changes. So if your server is fairly consistent on what ports should be open, this could definitely be a red flag.

share|improve this answer

nessus is free for personal use I think. this is up to date.

share|improve this answer
That's more of an external vulnerability scanner. Most rootkits periodically check for updates from Command and Control instead of opening a listening port now. – Hyppy Jun 13 '12 at 20:47
what you said is true, though nessus does find things that rootkits tend to modify and indirectly can discover problems related to rk attacks. – johnshen64 Jun 13 '12 at 20:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.