From owner-freebsd-questions@FreeBSD.ORG  Tue Nov  6 16:54:29 2007
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 8381F16A468
	for <freebsd-questions@freebsd.org>;
	Tue,  6 Nov 2007 16:54:29 +0000 (UTC)
	(envelope-from per-olof.nilsson@comhem.se)
Received: from ch-smtp02.sth.basefarm.net (ch-smtp02.sth.basefarm.net
	[80.76.149.213])
	by mx1.freebsd.org (Postfix) with ESMTP id 3D05A13C4AA
	for <freebsd-questions@freebsd.org>;
	Tue,  6 Nov 2007 16:54:29 +0000 (UTC)
	(envelope-from per-olof.nilsson@comhem.se)
Received: from c83-249-34-129.bredband.comhem.se ([83.249.34.129]:55827)
	by ch-smtp02.sth.basefarm.net with esmtp (Exim 4.68)
	(envelope-from <per-olof.nilsson@comhem.se>) id 1IpRh5-0002G4-8G
	for freebsd-questions@freebsd.org; Tue, 06 Nov 2007 17:54:27 +0100
From: Peo Nilsson <per-olof.nilsson@comhem.se>
To: FreeBSD quest-list <freebsd-questions@freebsd.org>
In-Reply-To: <44sl3jjsw2.fsf@be-well.ilk.org>
References: <1194271235.19142.4.camel@zeus.se> <44sl3jjsw2.fsf@be-well.ilk.org>
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
	boundary="=-ozwXDvRpnb/bbOwkwpmG"
Date: Tue, 06 Nov 2007 17:54:17 +0100
Message-Id: <1194368058.68992.3.camel@zeus.se>
Mime-Version: 1.0
X-Mailer: Evolution 2.12.1 FreeBSD GNOME Team Port 
X-Originating-IP: 83.249.34.129
X-Scan-Result: No virus found in message 1IpRh5-0002G4-8G.
X-Scan-Signature: ch-smtp02.sth.basefarm.net 1IpRh5-0002G4-8G
	4ea411f52cb6eb8ea091d9aeefbb1ec5
Subject: Re: /usr/bin/whatis replaced by a script (correct?)
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 06 Nov 2007 16:54:29 -0000


--=-ozwXDvRpnb/bbOwkwpmG
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable


On Mon, 2007-11-05 at 22:31 -0500, Lowell Gilbert wrote:
> Peo Nilsson <per-olof.nilsson@comhem.se> writes:
>=20
> > When running rkhunter 1.3.0 I get those warnings:
> >
> > ...<snip>
> > /usr/bin/whatis' has been replaced by a script: /usr/bin/whatis:
> >  Bourne shell script text executable

> They aren't replaced.  They are all *supposed* to be scripts.

Thanks for the info.

After knowing this, I edited rkhunter.conf like this:
RTKT_FILE_WHITELIST=3D"/usr/bin/whatis /usr/sbin/adduser /usr/local/bin/GET=
 /usr/local/sbin/pkgdb"

When running 'rkhunter -c' I still get the same warnings as before...
What am I missing?

--=20
/Peo

--=-ozwXDvRpnb/bbOwkwpmG
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (FreeBSD)

iD8DBQBHMJw2gWSfflYlIbwRAjYRAKCpePyRhlODDv8s6W6vTgMrbeogigCgpD2T
p39F/IMdvs4ZbXv59+YJ87c=
=wD1Y
-----END PGP SIGNATURE-----

--=-ozwXDvRpnb/bbOwkwpmG--