On Thu, 2010-05-27 at 07:06 -0700, Duane Loftus wrote:
>
> I went into rkhunter.conf and commented out the line:
>
> #BINDIR="/bin /usr/bin /sbin /usr/sbin /usr/local/bin /usr/local/sbin
> /usr/libexec /usr
> /local/libexec"
>
Why?
> But I am still getting the "symbolic link: /etc/rc.local" response.
>
You will do (although BINDIR has absolutely nothing to do with it).
>
> Unfortunately, I messed around with rkhunter.conf before reading your
> advice to do a rkhunter.conf.local. Should I do another reinstall?
>
Yes, probably best. Using the installer program run './installer.sh
--remove' first, to remove the old RKH installation. Then reinstall
('./installer.sh --install'). Then leave the /etc/rkhunter.conf file
alone - completely.
Once installed run 'rkhunter --update --propupd'. Then run 'rkhunter -c
--sk'. Anything which produces warnings, which you know are
false-positives, then correct them using the configuration file options,
and putting them into your '/etc/rkhunter.conf.local' file. (This file
won't exist initially, you will have to create it.)
When RKH runs it will look at '/etc/rkhunter.conf', but will then look
at '/etc/rkhunter.conf.local' (if it exists) and override any previously
set options.
John.
--
John Horne, University of Plymouth, UK
Tel: +44 (0)1752 587287 Fax: +44 (0)1752 587001
------------------------------------------------------------------------------
_______________________________________________
Rkhunter-users mailing list
Rkhunter-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/rkhunter-users
