An anti-malware tool is installed
Requires that an anti-malware / rootkit scanner, rkhunter, chkrootkit, or ClamAV (clamscan), is installed to detect malicious software on the host.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
A compromised host is frequently used to host malware, rootkits or web shells. A rootkit/malware scanner provides a second line of defence: it inspects binaries, kernel modules and known indicators of compromise to surface infections that slip past prevention controls. Having no scanner means an infection can persist and spread without any detection mechanism on the machine itself.
What Pavois checks
Pavois verifies the effective state by testing whether rkhunter, chkrootkit or clamscan is actually on PATH (command -v). This confirms the binary is genuinely available to run a scan, rather than trusting a package database entry that could be stale.
describe command('for c in rkhunter chkrootkit clamscan; do command -v $c >/dev/null 2>&1 && { echo ok; exit; }; done; echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run command -v rkhunter chkrootkit clamscan, at least one path should be printed. To confirm it actually works, run rkhunter --check --sk or chkrootkit, or for ClamAV update signatures with freshclam then clamscan -r --infected /.
Inspect & investigate
rkhunter logs to /var/log/rkhunter.log; ClamAV's daemon and freshclam log under /var/log/clamav/. Scheduled runs also emit cron/email output. Package presence: dpkg -l rkhunter clamav / rpm -q clamav.
Remediation
No automated remediation is shipped, so apply it manually: install a scanner (apt install rkhunter / dnf install clamav clamav-update), update its signature/properties database (rkhunter --propupd, or freshclam for ClamAV), and schedule periodic scans via cron or a systemd timer.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| name | chkrootkit |
|---|---|
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing a scanner is non-disruptive. Be aware of operational cost: ClamAV's daemon (clamd) is memory-hungry and full scans are I/O and CPU intensive, schedule them off-peak. rkhunter is prone to false positives after legitimate updates, so refresh its baseline with rkhunter --propupd after patching to avoid alert fatigue. These tools detect, they do not remove malware on their own.