# Rkhunter as IPFire AddOn? **URL:** \ **Category:** Monitoring\ **Created:** [22 March 2021 00:55 UTC](https://community.ipfire.org/t/rkhunter-as-ipfire-addon/4950 "2021-03-22T00:55:54Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![mrichtsfeld](https://community.ipfire.org/user_avatar/community.ipfire.org/mrichtsfeld/32/7271_2.png) [@mrichtsfeld](https://community.ipfire.org/u/mrichtsfeld)\ **Post date:** [22 March 2021 00:55 UTC](https://community.ipfire.org/t/rkhunter-as-ipfire-addon/4950/1 "2021-03-22T00:55:54Z")
Hi, First, thanks for the amazing work you do with IPFire. I have a question regarding hardening IPFire. One of the tools I use on other systems is rkhunter. I also found this description ~~wiki.ipfire[dot]org/optimization/start/security\_hardening/rkhunter~~ on how to install it on IPFire. However, doesn’t it make sense to integrate it also as an add-on into Pakfire? Thanks in advance for any answers. * * * **EDIT** : the add-on rkhunter was removed many Core Updates ago… ---
**Author:** ![jon](https://community.ipfire.org/user_avatar/community.ipfire.org/jon/32/15363_2.png) [@jon](https://community.ipfire.org/u/jon)\ **Post date:** [22 March 2021 01:35 UTC](https://community.ipfire.org/t/rkhunter-as-ipfire-addon/4950/2 "2021-03-22T01:35:32Z")
Hi Martin - Welcome to the IPFire Community! Sorry to say the rootkit / rkhunter Wiki page is something that should have been deleted a couple of years ago. rootkit / rkhunter is not an official IPFire add-on. And it looks like it hasn’t been updated by the developer since February 2018. ---
**Author:** ![mrichtsfeld](https://community.ipfire.org/user_avatar/community.ipfire.org/mrichtsfeld/32/7271_2.png) [@mrichtsfeld](https://community.ipfire.org/u/mrichtsfeld)\ **Post date:** [22 March 2021 03:17 UTC](https://community.ipfire.org/t/rkhunter-as-ipfire-addon/4950/3 "2021-03-22T03:17:41Z")
@jon thank you for your quick reply, and I’m happy to be here in the Community. I have just checked [http://www.chkrootkit.org/](http://www.chkrootkit.org/), and they have their last release in December 2020. Might that be an option? Or any other rootkit checker or a good reason why none is necessary. Thank you for any help. ---
**Author:** ![jon](https://community.ipfire.org/user_avatar/community.ipfire.org/jon/32/15363_2.png) [@jon](https://community.ipfire.org/u/jon)\ **Post date:** [22 March 2021 04:41 UTC](https://community.ipfire.org/t/rkhunter-as-ipfire-addon/4950/4 "2021-03-22T04:41:11Z")
I’m not sure why rootkit would or would not be needed. I’ve never used one. I am guessing the chkrootkit would need to have an “open” software license. Hopefully someone else will stop by that can answer the questions better than I can… ---
**Author:** ![mrichtsfeld](https://community.ipfire.org/user_avatar/community.ipfire.org/mrichtsfeld/32/7271_2.png) [@mrichtsfeld](https://community.ipfire.org/u/mrichtsfeld)\ **Post date:** [22 March 2021 04:45 UTC](https://community.ipfire.org/t/rkhunter-as-ipfire-addon/4950/5 "2021-03-22T04:45:52Z")
Thank you for your answer. I quickly checked the license which can be found here: [chkrootkit -- locally checks for signs of a rootkit](http://www.chkrootkit.org/download/) and it looks free. Let’s see if someone else can also give details about a possible integration. ---
**Author:** ![ummeegge](https://community.ipfire.org/user_avatar/community.ipfire.org/ummeegge/32/16602_2.png) [@ummeegge](https://community.ipfire.org/u/ummeegge)\ **Post date:** [22 March 2021 05:38 UTC](https://community.ipfire.org/t/rkhunter-as-ipfire-addon/4950/6 "2021-03-22T05:38:06Z")
Hi all, since Core 142 a kernel rootkit protection has taking place in IPFires Core system with the kernel module signing → [blog.ipfire.org - Feature Highlights: Kernel Rootkit Protection in Core Update 142](https://blog.ipfire.org/post/feature-highlights-kernel-rootkit-protection-in-core-update-142) . As a beneath info IPFire do also provides a auditing tool → [wiki.ipfire.org - Lynis Addon](https://wiki.ipfire.org/addons/lynis) which is not for such cases but as mentioned above, the system does it´s protection according the topic by itself. Best, Erik ---
**Author:** ![mrichtsfeld](https://community.ipfire.org/user_avatar/community.ipfire.org/mrichtsfeld/32/7271_2.png) [@mrichtsfeld](https://community.ipfire.org/u/mrichtsfeld)\ **Post date:** [22 March 2021 08:35 UTC](https://community.ipfire.org/t/rkhunter-as-ipfire-addon/4950/7 "2021-03-22T08:35:38Z")
Hi @ummeegge, Thank you for your answer. I will check out the article you sent. I actually installed Lynis which also recommended installing a rootkit detector. It seems more like a tool to harden the system (as you mentioned). Anyway, your answer answered my question. I also wanted to ask about auditd integration, but I guess it is better to make a new thread for that? Thanks again ---
**Author:** ![jon](https://community.ipfire.org/user_avatar/community.ipfire.org/jon/32/15363_2.png) [@jon](https://community.ipfire.org/u/jon)\ **Post date:** [22 March 2021 13:48 UTC](https://community.ipfire.org/t/rkhunter-as-ipfire-addon/4950/8 "2021-03-22T13:48:24Z")
> [@mrichtsfeld](#): > > I also wanted to ask about auditd integration, but I guess it is better to make a new thread for that? yes please ---
**Author:** ![jon](https://community.ipfire.org/user_avatar/community.ipfire.org/jon/32/15363_2.png) [@jon](https://community.ipfire.org/u/jon)\ **Post date:** [25 July 2023 23:42 UTC](https://community.ipfire.org/t/rkhunter-as-ipfire-addon/4950/9 "2023-07-25T23:42:06Z")
Closed on 25 July 2023 23:42 UTC