2

I installed RKHunter (rootkit hunter) on Raspbian Jessie using "apt-get install". Before that I performed apt-get update and upgrade as well as autoclean.

When setting up RKHunter, the first few steps are working. But then for some reason I can't check the current values and store them as known-good values using sudo rkhunter --propupd.

I get the message Invalid SCRIPTWHITELIST configuration option: non-existent pathname: usr/bin/lwp-request

Why am I getting this and how can I fix it please ?

I followed the following guide however I didn't install from sources but with apt-get: https://www.digitalocean.com/community/tutorials/how-to-use-rkhunter-to-guard-against-rootkits-on-an-ubuntu-vps

Improve this question

3 Answers 3

Reset to default
4

Since nobody stepped up I continued searching and found a few things that I think can help answer this question for documentation's sake and future readers. Use at your own risk. If anyone has some insights or input as to the safety or logic of doing this please let us know.

Potential answer/solution: Based on the following links, it seems that it is possible and safe to comment out the offending elements out of the /etc/rkhunter.conf file.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773974 http://www.itrig.de/index.php?/archives/2182-Rkhunter-Rootkit-Hunter-und-Chrootkit-auf-Ubuntu-installieren,-aktualisieren-und-konfigurieren.html ("Troubleshooting" part).

Will test it out and report back.

Improve this answer
2
  • Checking back to conclude: commented out the option regarding usr/bin/lwp-request in /etc/rkhunter.conf as explained at bugs.debian.org/cgi-bin/bugreport.cgi?bug=773974. It worked and now rkhunter executes normally. Use at your own risk.
    – MFJC
    Commented May 8, 2017 at 9:35
  • 3
    Hi, for me, the paths were just different. Files which were supposed to be under /usr/bin were under /bin/ and the like.
    – Till Kolditz
    Commented Jun 7, 2020 at 21:01
3

I know this is old. All you need to do is change the rkhunter.conf lines 593-600 to reflect location of egrep, fgrep, etc. Here is what it looks like.

SCRIPTWHITELIST=/usr/bin/egrep
SCRIPTWHITELIST=/usr/bin/fgrep
SCRIPTWHITELIST=/usr/bin/which
SCRIPTWHITELIST=/usr/bin/ldd
#SCRIPTWHITELIST=/usr/bin/lwp-request
SCRIPTWHITELIST=/usr/sbin/adduser
#SCRIPTWHITELIST=/usr/sbin/prelink
#SCRIPTWHITELIST=/usr/sbin/unhide.rb
Improve this answer
1
  • 2
    Thank you! Confirming in 2021, under Ubuntu 20.04.2 LTS the offending files were egrep and freg, which actually live in /bin.
    – Andy Giesler
    Commented Aug 5, 2021 at 14:04
0

getting this error is simple problem it mean in the /etc/rkhunter.conf there have a addisional command so u need the remove that rkhunter.conf file and replace it with new rkhunter.conf file from this link https://www.mediafire.com/file/ojtay83m4nwrroa/rkhunter.conf/file

Improve this answer
1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Sep 21, 2021 at 9:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.