Re: [Rkhunter-users] The Rootkit Hunter project team announcesrelease 1.3.4

[John H. <joh...@pl...>]

On Thu, 2009-01-01 at 00:24 +0100, Jim Knuth wrote:
> am 31.12.2008 23:20 Uhr schrieb John Horne:
> 
> 
> > On Wed, 2008-12-31 at 02:34 +0100, Jim Knuth wrote:
> >> The new version brings 6 warnings, a la:
> >>
> >> ../which ... has been replaced by a script
> >>
> >> with sudo rkhunter --propupd, no changing, the same.
> >>
> >> What can I do? Thanx in advance.
> >>
> > You can whitelist known script commands in your /etc/rkhunter.conf file
> > with the SCRIPTWHITELIST option.
> 
> why? Before (1.3.2) was everything ok.
> 
> > 
> > Secondly, if the previous version of RKH did not report these files as scripts
> 
> no, everything was fine. AND rkhunter --propupd has no effect
> 
> > then I am a bit confused/concerned.
> 
> I`m too. ;)
> 
Okay. Can you run 'file .../which' (for wherever your 'which' command is
located). I just want to make sure that the file is actually a script.
What O/S are you running?
Are you using the PKGMGR option at all in your rkhunter.conf file?




John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: Joh...@pl...       Fax: +44 (0)1752 587001