On Thu, 2010-05-27 at 15:33 +0100, John Horne wrote: > On Thu, 2010-05-27 at 07:06 -0700, Duane Loftus wrote: > > > > I went into rkhunter.conf and commented out the line: > > > > #BINDIR="/bin /usr/bin /sbin /usr/sbin /usr/local/bin /usr/local/sbin > > /usr/libexec /usr > > /local/libexec" > > > Why? > > > But I am still getting the "symbolic link: /etc/rc.local" response. > > > You will do (although BINDIR has absolutely nothing to do with it). > > > > > Unfortunately, I messed around with rkhunter.conf before reading your > > advice to do a rkhunter.conf.local. Should I do another reinstall? > > > Yes, probably best. Using the installer program run './installer.sh > --remove' first, to remove the old RKH installation. Then reinstall > ('./installer.sh --install'). Then leave the /etc/rkhunter.conf file > alone - completely. *SNIP*
Yea! I'm getting good at installing and reinstalling rkhunter! Per your instructions, I created a rkhunter.conf.local file and I'm NOT TOUCHING the original. Now, we can move on to actually using rkhunter. The first scan produced a number of warnings. Practically ALL of the "properties checks" produced a warning (see below). Is this a configuration error? [08:36:46] Performing file properties checks [08:36:46] Info: Starting test name 'properties' [08:36:46] Checking for prerequisites [ OK ] [08:36:47] /bin/awk [ OK ] [08:36:50] /bin/basename [ Warning ] [08:36:50] Warning: Package manager verification has failed: [08:36:50] File: /bin/basename [08:36:50] The file modification time has changed [08:36:51] /bin/bash [ Warning ] [08:36:51] Warning: Package manager verification has failed: [08:36:51] File: /bin/bash [08:36:51] The file modification time has changed [08:36:52] /bin/cat [ Warning ] [08:36:52] Warning: Package manager verification has failed: [08:36:52] File: /bin/cat [08:36:52] The file modification time has changed [08:36:53] /bin/chmod [ Warning ] [08:36:53] Warning: Package manager verification has failed: [08:36:53] File: /bin/chmod [08:36:53] The file modification time has changed [08:36:54] /bin/chown [ Warning ] ------------------------------------------------------------------------------ _______________________________________________ Rkhunter-users mailing list Rkhunter-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/rkhunter-users