Re: [Rkhunter-users] Update failed - wrong link

[John H. <joh...@pl...>]

On Thu, 2021-07-01 at 17:42 +0200, Ewert, Steffen wrote:
>
> I have here a Debian 10 system. Every time if I do a "rkhunter --update" I
> get
>
> | [17:30:24] Running Rootkit Hunter version 1.4.6 on DFlExt4
> | [17:30:24]
> | [17:30:24] Info: Start date is Thu 01 Jul 2021 05:30:24 PM CEST
> | [17:30:24]
> | [17:30:24] Checking configuration file and command-line options...
> | [17:30:24] Info: Detected operating system is 'Linux'
> | [17:30:24] Info: Found O/S name: Debian GNU/Linux 10 (buster)
> ...
> | [17:30:24]
> | [17:30:24] Checking rkhunter data files...
> | [17:30:24] Info: Created temporary file
> '/var/lib/rkhunter/tmp/rkhunter.upd.rObivgfPpM'
> | [17:30:24] Info: Created temporary file
> '/var/lib/rkhunter/tmp/mirrors.dat.SVrROABgWb'
> | [17:30:24] Info: The mirrors file has been rotated:
> /var/lib/rkhunter/db/mirrors.dat
> | [17:30:24] Info: Executing download command '/usr/bin/wget  -q -O
> "/var/lib/rkhunter/tmp/rkhunter.upd.rObivgfPpM"
> https://rkhunter.sourceforge.io/mirrors.dat 2>/dev/null'
> | [17:30:25] Info: Download failed - 1 mirror(s) left.
> | [17:30:25] Info: Created temporary file
> '/var/lib/rkhunter/tmp/mirrors.dat.3VeWSgPHKp'
> | [17:30:25] Info: The mirrors file has been rotated:
> /var/lib/rkhunter/db/mirrors.dat
> | [17:30:25] Info: Executing download command '/usr/bin/wget  -q -O
> "/var/lib/rkhunter/tmp/rkhunter.upd.rObivgfPpM"
> https://rkhunter.sourceforge.io/mirrors.dat 2>/dev/null'
> | [17:30:26] Warning: Download of 'mirrors.dat' failed: Unable to determine
> the latest version number.
> | [17:30:26] Checking file mirrors.dat                         [ Update
> failed ]
> | [17:30:26] Info: Executing download command '/usr/bin/wget  -q -O
> "/var/lib/rkhunter/tmp/rkhunter.upd.rObivgfPpM"
> https://rkhunter.sourceforge.io/programs_bad.dat 2>/dev/null'
> | [17:30:27] Info: Download failed - 1 mirror(s) left.
>
Hello,

I have been using a test Debian 10 server (for other work), and have just
installed rkhunter via apt.

I was a bit surprised in that the supplied configuration file is obviously
wrong. Trying to run an '--update' it seems they have set the WEB_CMD config
option to (literally) "/bin/false" (i.e with the double-quotes). However,
double-quotes are a perfectly valid filename character. So RKH sees this as a
relative file name, and fails before doing much at all.

I created a /etc/rkhunter.conf.local file containing 'WEB_CMD=wget'.

As to your problem, they have also set the MIRRORS_MODE option such that RKH
expects local mirrors. To the rkhunter.conf.local file I added
'MIRRORS_MODE=0'.
Updates now worked. However, they have also configured RKH not to update any of
the language files (except 'en'). No problem with that really, but it's not
exactly user-friendly! (If you want to enable this, then add 'UPDATE_LANG=' to
the /etc/rkhunter.conf.local file.)

Finally it seems they have disabled the mirrors file itself from being updated
- which is obviously useful if you are using local mirrors. However, if you
have modified the mirrors mode to use remote mirrors, then you may also want to
set 'UPDATE_MIRRORS=1'.



John.

--
John Horne | Senior Operations Analyst | Technology and Information Services
University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK
________________________________
[http://www.plymouth.ac.uk/images/email_footer.gif]<http://www.plymouth.ac.uk/worldclass>

This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form.