Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running Ubuntu 10.04.1 LTS . I am running rkhunter to check for rootkits.

rkhunter is complaining about the following hidden files and directories. I think these files are not a real problem on my system, but how can I check to see if these files are legitimate files?

[07:57:45]   Checking for hidden files and directories       [ Warning ]
[07:57:45] Warning: Hidden directory found: /etc/.java
[07:57:45] Warning: Hidden directory found: /dev/.udev
[07:57:45] Warning: Hidden directory found: /dev/.initramfs


Turns out that these directories are specifically mentioned in /etc/rkhunter.conf , which suggests that this is a frequently asked rkhunter question. From rkhunter.conf :

# Allow the specified hidden directories.
# One directory per line (use multiple ALLOWHIDDENDIR lines).
share|improve this question
up vote 15 down vote accepted

Basically ask Google, but those 3 are not dangerous!

/etc/.java is created by sun-java (and possible also by OpenJDK) /dev/.udev is created by the udevd daemon /dev/.initramfs is if I remember correctly where the initial ram filesystem is mounted during the system boot process.

share|improve this answer
+1 You get similar false positives in chkrootkit too. It is because rkhunter is set up to treat hidden directories as suspicious. – Richard Holloway Aug 9 '10 at 14:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.