diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.conf
--- rkhunter-1.4.2.orig/files/rkhunter.conf 2014-01-25 14:29:51.000000000 -0700
+++ rkhunter-1.4.2/files/rkhunter.conf 2014-04-06 11:43:15.719800756 -0600
@@ -155,6 +155,7 @@
# default directory beneath the installation directory.
#
#TMPDIR=/var/lib/rkhunter/tmp
+TMPDIR=/var/lib/rkhunter
#
# This option specifies the database directory to use.
@@ -163,7 +164,7 @@
# subsequently commented out or removed, then the program will assume a
# default directory beneath the installation directory.
#
-#DBDIR=/var/lib/rkhunter/db
+DBDIR=/var/lib/rkhunter/db
#
# This option specifies the script directory to use.
@@ -172,6 +173,7 @@
# subsequently commented out or removed, then the program will not run.
#
#SCRIPTDIR=/usr/local/lib/rkhunter/scripts
+SCRIPTDIR=/usr/share/rkhunter/scripts
#
# This option can be used to modify the command directory list used by rkhunter
@@ -228,7 +230,7 @@
#
# The default value is '/var/log/rkhunter.log'.
#
-LOGFILE=/var/log/rkhunter.log
+LOGFILE=/var/log/rkhunter/rkhunter.log
#
# Set this option to '1' if the log file is to be appended to whenever rkhunter
@@ -238,6 +240,7 @@
# The default value is '0'.
#
#APPEND_LOG=0
+APPEND_LOG=1
#
# Set the following option to '1' if the log file is to be copied when rkhunter
@@ -304,6 +307,7 @@
# The default value is 'no'.
#
#ALLOW_SSH_ROOT_USER=no
+ALLOW_SSH_ROOT_USER=unset
#
# Set this option to '1' to allow the use of the SSH-1 protocol, but note
@@ -318,6 +322,7 @@
# The default value is '0'.
#
#ALLOW_SSH_PROT_V1=0
+ALLOW_SSH_PROT_V1=2
#
# This setting tells rkhunter the directory containing the SSH configuration
@@ -350,7 +355,8 @@
# program defaults.
#
ENABLE_TESTS=ALL
-DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps
+#DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps
+DISABLE_TESTS=suspscan hidden_ports deleted_files packet_cap_apps apps
#
# The HASH_CMD option can be used to specify the command to use for the file
@@ -422,6 +428,7 @@
# Also see the PKGMGR_NO_VRFY and USE_SUNSUM options.
#
#PKGMGR=NONE
+PKGMGR=RPM
#
# It is possible that a file, which is part of a package, may have been
@@ -545,6 +552,14 @@
# The default value is the null string.
#
#EXISTWHITELIST=""
+EXISTWHITELIST=/bin/ad
+# FreeIPA Certificate Authority
+EXISTWHITELIST=/var/log/pki-ca/system
+# FreeIPA Certificate Authority
+EXISTWHITELIST=/var/log/pki/pki-tomcat/ca/system
+# Some non default installed files we check
+EXISTWHITELIST=/usr/bin/GET
+EXISTWHITELIST=/usr/bin/whatis
#
# Whitelist various attributes of the specified file. The attributes are those
@@ -575,6 +590,12 @@
# The default value is the null string.
#
#SCRIPTWHITELIST=/usr/bin/groups
+SCRIPTWHITELIST=/usr/bin/whatis
+SCRIPTWHITELIST=/usr/bin/ldd
+SCRIPTWHITELIST=/usr/bin/groups
+SCRIPTWHITELIST=/usr/bin/GET
+SCRIPTWHITELIST=/sbin/ifup
+SCRIPTWHITELIST=/sbin/ifdown
#
# Allow the specified file to have the immutable attribute set.
@@ -605,6 +626,19 @@
#ALLOWHIDDENDIR=/dev/.udev
#ALLOWHIDDENDIR=/dev/.udevdb
#ALLOWHIDDENDIR=/dev/.mdadm
+ALLOWHIDDENDIR="/etc/.java"
+ALLOWHIDDENDIR=/dev/.udev
+ALLOWHIDDENDIR=/dev/.udevdb
+ALLOWHIDDENDIR=/dev/.udev.tdb
+ALLOWHIDDENDIR=/dev/.static
+ALLOWHIDDENDIR=/dev/.initramfs
+ALLOWHIDDENDIR=/dev/.SRC-unix
+ALLOWHIDDENDIR=/dev/.mdadm
+ALLOWHIDDENDIR=/dev/.systemd
+ALLOWHIDDENDIR=/dev/.mount
+# for etckeeper
+ALLOWHIDDENDIR=/etc/.git
+ALLOWHIDDENDIR=/etc/.bzr
#
# Allow the specified hidden file to be whitelisted.
@@ -620,6 +654,30 @@
#ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
#ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
#ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
+ALLOWHIDDENFILE="/usr/share/man/man1/..1.gz"
+ALLOWHIDDENFILE=/lib*/.libcrypto.so.*.hmac
+ALLOWHIDDENFILE=/lib*/.libssl.so.*.hmac
+ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac
+ALLOWHIDDENFILE=/usr/bin/.ssh.hmac
+ALLOWHIDDENFILE=/usr/bin/.ssh-keygen.hmac
+ALLOWHIDDENFILE=/usr/bin/.ssh-keyscan.hmac
+ALLOWHIDDENFILE=/usr/bin/.ssh-add.hmac
+ALLOWHIDDENFILE=/usr/bin/.ssh-agent.hmac
+ALLOWHIDDENFILE=/usr/lib*/.libfipscheck.so.*.hmac
+ALLOWHIDDENFILE=/usr/lib*/.libgcrypt.so.*.hmac
+ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha1hmac.hmac
+ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha256hmac.hmac
+ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha384hmac.hmac
+ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha512hmac.hmac
+ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
+ALLOWHIDDENFILE=/dev/.mdadm.map
+ALLOWHIDDENFILE=/usr/share/man/man5/.k5login.5.gz
+ALLOWHIDDENFILE=/usr/share/man/man5/.k5identity.5.gz
+ALLOWHIDDENFILE=/usr/sbin/.ipsec.hmac
+# etckeeper
+ALLOWHIDDENFILE=/etc/.etckeeper
+ALLOWHIDDENFILE=/etc/.gitignore
+ALLOWHIDDENFILE=/etc/.bzrignore
#
# Allow the specified process to use deleted files. The process name may be
@@ -681,6 +739,18 @@
#
#ALLOWDEVFILE=/dev/shm/pulse-shm-*
#ALLOWDEVFILE=/dev/shm/sem.ADBE_*
+ALLOWDEVFILE=/dev/shm/pulse-shm-*
+ALLOWDEVFILE=/dev/md/md-device-map
+# tomboy creates this one
+ALLOWDEVFILE="/dev/shm/mono.*"
+# created by libv4l
+ALLOWDEVFILE="/dev/shm/libv4l-*"
+# created by spice video
+ALLOWDEVFILE="/dev/shm/spice.*"
+# created by mdadm
+ALLOWDEVFILE="/dev/md/autorebuild.pid"
+# 389 Directory Server
+ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats
#
# This option is used to indicate if the Phalanx2 test is to perform a basic
@@ -1004,6 +1074,11 @@
#
#RTKT_DIR_WHITELIST=""
#RTKT_FILE_WHITELIST=""
+RTKT_FILE_WHITELIST=/bin/ad
+# FreeIPA Certificate Authority
+RTKT_FILE_WHITELIST=/var/log/pki-ca/system
+# FreeIPA Certificate Authority
+RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/ca/system
#
# The following option can be used to whitelist shared library files that would
@@ -1222,3 +1297,5 @@
#
#EMPTY_LOGFILES=""
#MISSING_LOGFILES=""
+
+INSTALLDIR="/usr"