On Thu, Jul 28, 2011 at 11:41:15PM +0100, John Horne wrote: > On Thu, 2011-07-28 at 15:18 -0700, Robert Holtzman wrote: > > > Now the configuration file looks like: > > > > RTKT_FILE_WHITELIST="/etc/init.d/hdparm" "/etc/init.d/.depend.boot" > > > > running rkhunter -c gives > > > > Whitelisted rootkit file does not exist: /etc/init.d/hdparm" > > Whitelisted rootkit file does not exist: "/etc/init.d/.depend.boot > > > > ls -a shows both files. > > > RKH is treating the internal quotes as part of the name. Try using: > > RTKT_FILE_WHITELIST="/etc/init.d/hdparm" > RTKT_FILE_WHITELIST="/etc/init.d/.depend.boot" > > or > > RTKT_FILE_WHITELIST="/etc/init.d/hdparm /etc/init.d/.depend.boot"
That did it. Thanks -- Bob Holtzman If you think you're getting free lunch, check the price of the beer. Key ID: 8D549279
signature.asc
Description: Digital signature
------------------------------------------------------------------------------ Got Input? Slashdot Needs You. Take our quick survey online. Come on, we don't ask for help often. Plus, you'll get a chance to win $100 to spend on ThinkGeek. http://p.sf.net/sfu/slashdot-survey
_______________________________________________ Rkhunter-users mailing list Rkhunter-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/rkhunter-users
