# Install rkhunter with Homebrew, apt, dnf, MacPorts, pacman

Rootkit hunter. Version 1.4.6 via Homebrew; verified from local package data. Also installable with debian: sudo apt install rkhunter.

## Install

```sh
sudo av install brew:rkhunter
```

Additional install commands:

### macOS

- Homebrew (100%):

```sh
brew install rkhunter
```

  Evidence: local Homebrew formula metadata

- MacPorts (94%):

```sh
sudo port install rkhunter
```

  Evidence: MacPorts ports tree: sysutils/rkhunter/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

### Linux

- Debian apt (92%):

```sh
sudo apt install rkhunter
```

  Evidence: Debian stable package indexes: rkhunter from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz

- dnf (92%):

```sh
sudo dnf install rkhunter
```

  Evidence: Fedora Rawhide package metadata: rkhunter from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst

- pacman (92%):

```sh
sudo pacman -S rkhunter
```

  Evidence: Arch Linux sync databases: rkhunter from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz

## Package facts

- **Package key:** brew:rkhunter
- **Package manager:** Homebrew
- **Version:** 1.4.6
- **Source summary:** Rootkit hunter
- **Homepage:** <https://rkhunter.sourceforge.net/>
- **Generated:** 2026-08-03T19:37:03+00:00

## Executables

- rkhunter (alias)

## Install behavior

- Bottle: not available

## Freshness

- Page generated: 2026-08-03
- Package-manager version: 1.4.6

## Security Notes

narrow executable package without higher-risk signals.

- **Geiger risk:** green / low
- narrow executable package without higher-risk signals


## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Configuration files

- Unix: /etc/rkhunter.conf, /usr/local/etc/rkhunter.conf
## Other Package-Manager Records

- Debian apt - rkhunter - 1.4.6-13: normalized package name match | Debian stable package indexes: rkhunter from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | rootkit, backdoor, sniffer and exploit scanner | https://rkhunter.sourceforge.net
- Ubuntu apt - rkhunter - 1.4.6-12: normalized package name match | Ubuntu 24.04 LTS package indexes: rkhunter from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | rootkit, backdoor, sniffer and exploit scanner | https://rkhunter.sourceforge.net
- dnf - rkhunter - 1.4.6-33.fc45: normalized package name match | Fedora Rawhide package metadata: rkhunter from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | A host-based tool to scan for rootkits, backdoors and local exploits | http://rkhunter.sourceforge.net/
- pacman - rkhunter - 1.4.6-4: normalized package name match | Arch Linux sync databases: rkhunter from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Checks machines for the presence of rootkits and other unwanted tools. | http://rkhunter.sourceforge.net/
- MacPorts - rkhunter: normalized package name match | MacPorts ports tree: sysutils/rkhunter/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1


## Combined YAML source

View the package source record on GitHub. [combined/rkhunter.yml](https://github.com/mxcl/pkgdb/blob/main/combined/rkhunter.yml)


## Sources

- pkg.so package database
- Geiger risk classifier
- curated configuration and credential file locations
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph