>> ... as you can see, I have added /sbin/ifup to SCRIPTWHITELIST however >> it still seems to show as a warning!? >> Is it because I am using PKGMGR=RPM? > > Yes. If you run 'rpm -Vf /sbin/ifup' it will show that the RPM package > manager thinks the file has changed (probably showing 5, S and T as > having changed). If the file was updated recently, then the package > manager database does not seem to have been correspondingly changed. You > may want to ensure that the rest of the package is valid (although the > 'rpm -Vf' command will check the whole package anyway).
Thank you, your right... # rpm -Vf /sbin/ifup .M...... c /etc/adjtime S.5....T c /etc/inittab SM5....T c /etc/rc.d/init.d/halt S.5....T c /etc/rc.d/rc.local .......T c /etc/rc.d/rc.sysinit S.5....T c /sbin/ifup So what is the fix? Sorry if this is a silly question and I'm aware I may be going away from RKH support but do I need to somehow "re-sync" the RPM package manager? Or can I whitelist this in RKH? Regards, Dan ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Rkhunter-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/rkhunter-users
