Re: [Rkhunter-users] Rootkit Hunter on Oracle Linux 8

[John D. <jwa...@gm...>]

I can only think to ask, what does,

	ls -laRZ /usr/libexec/*awk

say on each machine, are they different (& binary wise?), are remote filesystems
involved, do the gawk package/binaries on each server verify, does/did a package
update occur when rkhunter ran causing a race, etc.

Cheers

John


On Wed, 2021-05-19 at 15:17 -0700, opa...@do... wrote:
> On some of my OL8 servers, rkhunter throws this warning:
> 
> Warning: No hash value found for file '/usr/libexec/gawk' in the 
> 'rkhunter.dat' file.
> 
> /usr/libexec/gawk is a symlink to /usr/libexec/awk.  Which, in turn, is 
> a directory
> 
> $ file /usr/libexec/gawk
> /usr/libexec/gawk: symbolic link to /usr/libexec/awk
> 
> $ file /usr/libexec/awk
> /usr/libexec/awk: directory
> 
> This does not affect all the nodes. Some seem to behave normally.
> 
> Running rkhunter on the affected nodes with --propupd does not fix it.
> 
> I am using rkhunter 1.4.6
> 
> Suggestions?
>