Resolved Watchdog does not install Rootkit Hunter

[Hangover2]

Server operating system version

Debian 11

Plesk version and microupdate number

Plesk Obsidian 18.0.68 Update #2

Hello,

In the past, the Plesk Watchdog extension was bundled with rkhunter. We tried out the new Watchdog v3.x release from early March 2025.

Since then, the security report shows the following error every week:

/opt/psa/admin/sbin/modules/watchdog/schedule: 8: /usr/local/psa/admin/bin/modules/watchdog/rkhunter: not found

Did we miss something, or what is the best practice nowadays for using rkhunter with the Watchdog extension in Plesk?

Thanks in advance for any help!

 

[AYamshanov]

Hi Hangover2,

It is expected. We deprecated it (see deprecation-plan) since there are no actual updates, and it creates a false sense of security that everything is fine. If you need an alternative free malware file scanner, you can install the Imunify extension as a good replacement for the RKHunter.

• To replace RKHunter, use a different solution. For example, the free version of the Imunify extension comes with a fully-featured malware file scanner, and also reputation and blacklist status monitoring.

See also The Rootkit Hunter project, the last release was 7 years ago,

Rootkit Hunter release 1.4.6 (February 20th 2018)

Note: If you want to continue using rkhunter, the only option here is to install/configure it manually with a system package manager.

 

[King555]

@AYamshanov
But why is it still possible to enable the security scan in the settings of the latest Watchdog? And there is also a message like this in the daily report: [Mar 16, 2025 02:36 AM] Security scanning report is in the file /opt/psa/var/modules/watchdog//report/security_2025-03-16.

Shouldn't this be removed?

 

[AYamshanov]

Agree
A half hour ago, we released a new version of Watchdog with some changes and fixes,

3.1.0 (14 April 2025)​

• Change package and repository signing key.
• Removed support for rkhunter.
• [-] Monit will no longer incorrectly flag sw-engine service as "Disabled due to frequent shutdowns" on Ubuntu 24.04, caused by the lack of proper service capabilities. (EXTPLESK-8838)
• [-] Monit configuration is now correctly updated when nginxmng -d or nginxmng -e is used and Plesk 18.0.69 or newer is used. (EXTPLESK-6368)
• [-] Watchdog will no longer attempt to activate fail2ban service if it is installed, but not configured. (EXTPLESK-8764)