{% if ansible_controlled is defined and ansible_controlled != "" %}
#
# {{ ansible_controlled }}
#
{% endif %}
#
# This is the main configuration file for Rootkit Hunter.
#
# You can either modify this file directly, or you can create a local
# configuration file. The local file must be named 'rkhunter.conf.local',
# and must reside in the same directory as this file. Please modify one
# or both files to your own requirements.
#
# Please review the documentation before posting bug reports or questions.
# To report bugs, obtain updates, or provide patches or comments, please go to:
# http://rkhunter.sourceforge.net
#
# To ask questions about rkhunter, please use the rkhunter-users mailing list.
# Note this is a moderated list: please subscribe before posting.
#
# Lines beginning with a hash (#), and blank lines, are ignored.
# End-of-line comments are not supported.
#
# Most of the following options need only be specified once. If
# they appear more than once, then the last one seen will be used.
# Some options are allowed to appear more than once, and the text
# describing the option will say if this is so.
#


#
# If this option is set to 1, it specifies that the mirrors file
# ('mirrors.dat'), which is used when the '--update' and '--versioncheck'
# options are used, is to be rotated. Rotating the entries in the file
# allows a basic form of load-balancing between the mirror sites whenever
# the above options are used.
# If the option is set to 0, then the mirrors will be treated as if in
# a priority list. That is, the first mirror listed will always be used
# first. The second mirror will only be used if the first mirror fails,
# the third mirror will only be used if the second mirror fails, and so on.
#
# If the mirrors file is read-only, then the '--versioncheck' command-line
# option can only be used if this option is set to 0.
#
ROTATE_MIRRORS=1

#
# If this option is set to 1, it specifies that when the '--update'
# option is used, then the mirrors file is to be checked for updates
# as well. If the current mirrors file contains any local mirrors,
# these will be prepended to the updated file.
# If this option is set to 0, the mirrors file can only be updated
# manually. This may be useful if only using local mirrors.
#
UPDATE_MIRRORS=1

#
# The MIRRORS_MODE option tells rkhunter which mirrors are to be
# used when the '--update' or '--versioncheck' command-line options
# are given. Possible values are:
#     0 - use any mirror (the default)
#     1 - only use local mirrors
#     2 - only use remote mirrors
#
# Local and remote mirrors can be defined in the mirrors file
# by using the 'local=' and 'remote=' keywords respectively.
#
MIRRORS_MODE=0

#
# Email a message to this address if a warning is found when the
# system is being checked. Multiple addresses may be specified
# simply be separating them with a space. Setting this option to
# null disables the option.
#
# NOTE: This option should be present in the configuration file.
#
#MAIL-ON-WARNING=me@mydomain   root@mydomain
MAIL-ON-WARNING=""

#
# Specify the mail command to use if MAIL-ON-WARNING is set.
# NOTE: Double quotes are not required around the command, but
# are required around the subject line if it contains spaces.
#
MAIL_CMD=mail -s "[rkhunter] Warnings found for ${HOST_NAME}"

#
# Specify the temporary directory to use.
#
# NOTE: Do not use /tmp as your temporary directory. Some
# important files will be written to this directory, so be
# sure that the directory permissions are tight.
#
TMPDIR=/var/lib/rkhunter/tmp

#
# Specify the database directory to use.
#
DBDIR=/var/lib/rkhunter/db

#
# Specify the script directory to use.
#
SCRIPTDIR=/usr/share/rkhunter/scripts

#
# Specify the root directory to use.
#
#ROOTDIR=""

#
# Specify the command directories to be checked. This is a
# space-separated list of directories.
#
BINDIR="/bin /usr/bin /sbin /usr/sbin /usr/local/bin /usr/local/sbin /usr/libexec /usr/local/libexec"

#
# Specify the default language to use. This should be similar
# to the ISO 639 language code.
#
# NOTE: Please ensure that the language you specify is supported.
#       For a list of supported languages use the following command:
#
#           rkhunter --lang en --list languages
#
#LANGUAGE=en

#
# This option is a space-separated list of the languages that are to
# be updated when the '--update' option is used. If unset, then all
# the languages will be updated. If none of the languages are to be
# updated, then set this option to just 'en'.
#
# The default is for all the languages to be updated. The default
# language, specified above, and the English (en) language file will
# always be updated regardless of this option.
#
UPDATE_LANG=""

#
# Specify the log file pathname.
#
# NOTE: This option should be present in the configuration file.
#
LOGFILE=/var/log/rkhunter.log

#
# Set the following option to 1 if the log file is to be appended to
# whenever rkhunter is run.
#
APPEND_LOG=0

#
# Set the following option to 1 if the log file is to be copied when
# rkhunter finishes and an error or warning has occurred. The copied
# log file name will be appended with the current date and time
# (in YYYY-MM-DD_HH:MM:SS format).
# For example: rkhunter.log.2009-04-21_00:57:51
#
COPY_LOG_ON_ERROR=0

#
# Set the following option to enable the rkhunter check start and finish
# times to be logged by syslog. Warning messages will also be logged.
# The value of the option must be a standard syslog facility and
# priority, separated by a dot.
#
# For example: USE_SYSLOG=authpriv.warning
#
# Setting the value to 'none', or just leaving the option commented out,
# disables the use of syslog.
#
#USE_SYSLOG=authpriv.notice

#
# Set the following option to 1 if the second colour set is to be used.
# This can be useful if your screen uses black characters on a white
# background (for example, a PC instead of a server).
#
COLOR_SET2=0

#
# Set the following option to 0 if rkhunter should not detect if X is
# being used. If X is detected as being used, then the second colour
# set will automatically be used.
#
AUTO_X_DETECT=1

#
# Set the following option to 1 if it is wanted that any 'Whitelisted'
# results are shown in white rather than green. For colour set 2 users,
# setting this option will cause the result to be shown in black.
#
WHITELISTED_IS_WHITE=0

#
# The following option is checked against the SSH configuration file
# 'PermitRootLogin' option. A warning will be displayed if they do not
# match. However, if a value has not been set in the SSH configuration
# file, then a value here of 'yes' or 'unset' will not cause a warning.
# This option has a default value of 'no'.
#
ALLOW_SSH_ROOT_USER=without-password

#
# Set this option to '1' to allow the use of the SSH-1 protocol, but note
# that theoretically it is weaker, and therefore less secure, than the
# SSH-2 protocol. Do not modify this option unless you have good reasons
# to use the SSH-1 protocol (for instance for AFS token passing or Kerberos4
# authentication). If the 'Protocol' option has not been set in the SSH
# configuration file, then a value of '2' may be set here in order to
# suppress a warning message. This option has a default value of '0'.
#
ALLOW_SSH_PROT_V1=0

#
# This setting tells rkhunter the directory containing the SSH configuration
# file. This setting will be worked out by rkhunter, and so should not
# usually need to be set.
#
#SSH_CONFIG_DIR=/etc/ssh

#
# These two options determine which tests are to be performed.
# The ENABLE_TESTS option can use the word 'all' to refer to all the
# available tests. The DISABLE_TESTS option can use the word 'none' to
# mean that no tests are disabled. The list of disabled tests is applied to
# the list of enabled tests. Both options are space-separated lists of test
# names. The currently available test names can be seen by using the command
# 'rkhunter --list tests'.
#
# The program defaults are to enable all tests and disable none. However, if
# either option is specified in this file, then it overrides the program
# default. The supplied rkhunter.conf file has some tests already disabled,
# and these are tests that will be used only incidentally, can be considered
# "advanced" or those that are prone to produce more than the "average" number
# of "false positives".
#
# Please read the README file for more details about enabling and disabling
# tests, the test names, and how rkhunter behaves when these options are used.
#
# hidden_procs test requires the unhide command which is part of the unhide
# package in Debian.
#
# apps test is disabled by default as it triggers warnings about outdated 
# applications (and warns about possible security risk: we better trust
# the Debian Security Team).
#
ENABLE_TESTS="all"
{% set disable_tests = [] %}
{% if not ansible_virtualization_role is defined or ansible_virtualization_role != 'guest' %}
  {% if disable_tests.append('os_specific') %}{% endif %}
{%- endif %}
{% if not ansible_virtualization_role is defined or ansible_virtualization_role != 'host' %}
    {% if disable_tests.append('promisc') %}{% endif %}
{%- endif %}
DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps apps {{ disable_tests|join(' ') }}"

#
# The HASH_FUNC option can be used to specify the command to use
# for the file hash value check. It can be specified as just the
# command name or the full pathname. If just the command name is
# given, and it is one of MD5, SHA1, SHA224, SHA256, SHA384 or
# SHA512, then rkhunter will first look for the relevant command,
# such as 'sha256sum', and then for 'sha256'. If neither of these
# are found, it will then look to see if a perl module has been
# installed which will support the relevant hash function.
#
# The default is SHA1, or MD5 if SHA1 cannot be found.
#
# Systems using prelinking are restricted to using either the
# SHA1 or MD5 function.
#
# A value of 'NONE' (in uppercase) can be specified to indicate that
# no hash function should be used. Rootkit Hunter will detect this and
# automatically disable the file hash checks.
#
# Examples:
#   For Solaris 9 : HASH_FUNC=gmd5sum
#   For Solaris 10: HASH_FUNC=sha1sum
#   For AIX (>5.2): HASH_FUNC="csum -hMD5"
#   For NetBSD    : HASH_FUNC="cksum -a sha512"
#
# NOTE: If the hash function is changed then you MUST run rkhunter with
#       the '--propupd' option to rebuild the file properties database.
#
#HASH_FUNC=sha1sum

#
# The HASH_FLD_IDX option specifies which field from the HASH_FUNC
# command output contains the hash value. The fields are assumed to
# be space-separated. The default value is one, but for *BSD users
# rkhunter will, by default, use a value of 4 if the HASH_FUNC option
# has not been set. The option value must be a positive integer.
#
#HASH_FLD_IDX=4

#
# The PKGMGR option tells rkhunter to use the specified package manager
# to obtain the file property information. This is used when updating
# the file properties file ('rkhunter.dat'), and when running the file
# properties check. For RedHat/RPM-based systems, 'RPM' can be used
# to get information from the RPM database. For Debian-based systems
# 'DPKG' can be used, and for *BSD systems 'BSD' can be used.
# No value, or a value of 'NONE', indicates that no package manager
# is to be used. The default is 'NONE'.
#
# The current package managers store the file hash values using an
# MD5 hash function.
#
# The 'DPKG' and 'BSD' package managers only provide MD5 hash values.
# The 'RPM' package manager additionally provides values for the inode,
# file permissions, uid, gid and other values.
#
# For any file not part of a package, rkhunter will revert to using
# the HASH_FUNC hash function instead.
#
# Whenever this option is changed 'rkhunter --propupd' must be run.
#
# NONE is the default for Debian as well, as running --propupd takes
# about 4 times longer when it's set to DPKG
#
#PKGMGR=NONE

#
# It is possible that a file which is part of a package may be modified
# by the administrator. Typically this occurs for configuration files.
# However, the RPM verify function may list the file as being modified,
# it does for some but not for others depending on how the package was
# built. The PKGMGR_NO_VRFY option is a space-separated list of file
# pathnames which are to be exempt from the package manager verification
# process, and which will be treated as non-packaged files. As such, the
# files properties are still checked.
#
# This option may be used more than once. It only takes effect if the
# PKGMGR option has been set, and is not 'NONE'.
#
# Whenever this option is changed 'rkhunter --propupd' must be run.
#
#PKGMGR_NO_VRFY=""

#
# This option is a space-separated list of command pathnames. Rkhunter will
# ignore any prelink dependency errors for the given files. However, a
# warning will be issued if the error does not occur. As such this option
# must only be used on commands which experience a persistent problem.
#
# Short-term prelink dependency errors can usually be resolved simply by
# running the prelink command on the given pathname.
#
# NOTE: The command 'rkhunter --propupd' must be run whenever this option
# is changed.
#
#IGNORE_PRELINK_DEP_ERR="/bin/ps /usr/bin/top"

#
# This option is a space-separated list of commands, directories and file
# pathnames. This option can be specified more than once.
#
# Whenever this option is changed, 'rkhunter --propupd' must be run.
#
# Simple command names - for example, 'top' - and directory names are
# added to the internal list of directories to be searched for each of
# the command names in the command list. Additionally, full pathnames
# to files, which need not be commands, may be given. Any files or
# directories which are already part of the internal lists will be
# silently ignored from the configuration.
#
# Normal globbing wildcards are allowed, except for simple command names.
# For example, 'top*' cannot be given, but '/usr/bin/top*' is allowed.
#
# Specific files may be excluded by preceding their name with an
# exclamation mark (!). For example, '!/opt/top'. By combining this
# with wildcarding, whole directories can be excluded. For example,
# '/etc/* /etc/*/* !/etc/rc?.d/*'. This will look for files in the first
# two directory levels of '/etc'. However, anything in '/etc/rc0.d',
# '/etc/rc1.d', '/etc/rc2.d' and so on, will be excluded.
#
# NOTE: Only files and directories which have been added by the user,
# and are not part of the internal lists, can be excluded. So, for
# example, it is not possible to exclude the 'ps' command by using
# '!/bin/ps'. These will be silently ignored from the configuration.
#
#USER_FILEPROP_FILES_DIRS="top /usr/local/sbin !/opt/ps*"
#USER_FILEPROP_FILES_DIRS="/etc/rkhunter.conf"
#USER_FILEPROP_FILES_DIRS="/etc/rkhunter.conf.local"
#USER_FILEPROP_FILES_DIRS="/var/lib/rkhunter/db/*"
#USER_FILEPROP_FILES_DIRS="!/var/lib/rkhunter/db/mirrors.dat"
#USER_FILEPROP_FILES_DIRS="!/var/lib/rkhunter/db/rkhunter*"
#USER_FILEPROP_FILES_DIRS="/var/lib/rkhunter/db/i18n/*"

#
# Whitelist various attributes of the specified files.
# The attributes are those of the 'attributes' test.
# Specifying a file name here does not include it being
# whitelisted for the write permission test below.
# One command per line (use multiple ATTRWHITELIST lines).
#
#ATTRWHITELIST=/bin/ps

#
# Allow the specified commands to have the 'others'
# (world) permission have the write-bit set.
#
# For example, files with permissions r-xr-xrwx
# or rwxrwxrwx.
#
# One command per line (use multiple WRITEWHITELIST lines).
#
#WRITEWHITELIST=/bin/ps

#
# Allow the specified commands to be scripts.
# One command per line (use multiple SCRIPTWHITELIST lines).
#
SCRIPTWHITELIST=/bin/egrep
SCRIPTWHITELIST=/bin/fgrep
SCRIPTWHITELIST=/bin/which
SCRIPTWHITELIST=/usr/bin/groups
SCRIPTWHITELIST=/usr/bin/ldd
SCRIPTWHITELIST=/usr/bin/lwp-request
SCRIPTWHITELIST=/usr/sbin/adduser
SCRIPTWHITELIST=/usr/sbin/prelink

#
# Allow the specified commands to have the immutable attribute set.
# One command per line (use multiple IMMUTWHITELIST lines).
#
#IMMUTWHITELIST=/sbin/ifup

#
# Allow the specified hidden directories.
# One directory per line (use multiple ALLOWHIDDENDIR lines).
#
ALLOWHIDDENDIR=/etc/.java
ALLOWHIDDENDIR=/dev/.udev
#ALLOWHIDDENDIR=/dev/.udevdb
#ALLOWHIDDENDIR=/dev/.udev.tdb
#ALLOWHIDDENDIR=/dev/.static
ALLOWHIDDENDIR=/dev/.initramfs
#ALLOWHIDDENDIR=/dev/.SRC-unix
ALLOWHIDDENDIR=/dev/.mdadm
ALLOWHIDDENDIR=/dev/.git

#
# Allow the specified hidden files.
# One file per line (use multiple ALLOWHIDDENFILE lines).
# 
#ALLOWHIDDENFILE=/etc/.java
#ALLOWHIDDENFILE=/usr/share/man/man1/..1.gz
#ALLOWHIDDENFILE=/etc/.pwd.lock
#ALLOWHIDDENFILE=/etc/.init.state
#ALLOWHIDDENFILE=/lib/.libcrypto.so.0.9.8e.hmac
#ALLOWHIDDENFILE=/lib/.libcrypto.so.6.hmac
#ALLOWHIDDENFILE=/lib/.libssl.so.0.9.8e.hmac
#ALLOWHIDDENFILE=/lib/.libssl.so.6.hmac
#ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac
#ALLOWHIDDENFILE=/usr/bin/.ssh.hmac
#ALLOWHIDDENFILE=/usr/lib/.libfipscheck.so.1.1.0.hmac
#ALLOWHIDDENFILE=/usr/lib/.libfipscheck.so.1.hmac
#ALLOWHIDDENFILE=/usr/lib/.libgcrypt.so.11.hmac
#ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
#ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
#ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha384hmac.hmac
#ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha512hmac.hmac
#ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
#ALLOWHIDDENFILE=/usr/share/man/man5/.k5login.5.gz
ALLOWHIDDENFILE=/etc/.etckeeper
ALLOWHIDDENFILE=/etc/.gitignore

#
# Allow the specified processes to use deleted files.
# One process per line (use multiple ALLOWPROCDELFILE lines).
#
# The process name may be followed by a colon-separated list
# of full pathnames. The process will then only be whitelisted
# if it is using one of the given files. For example:
#
#     ALLOWPROCDELFILE=/usr/libexec/gconfd-2:/tmp/abc:/var/tmp/xyz
#
#ALLOWPROCDELFILE=/sbin/cardmgr
#ALLOWPROCDELFILE=/usr/sbin/gpm
#ALLOWPROCDELFILE=/usr/lib/libgconf2-4/gconfd-2
#ALLOWPROCDELFILE=/usr/sbin/mysqld
#ALLOWPROCDELFILE=/usr/lib/iceweasel/firefox-bin
#ALLOWPROCDELFILE=/usr/bin/file-roller

#
# Allow the specified network interfaces to be in promiscuous mode.
# This is a space-separated list of interface names.
#
#ALLOWPROMISCIF="eth0"

#
# Allow the specified processes to listen on any network interface.
# One process per line (use multiple ALLOWPROCLISTEN lines).
#
#ALLOWPROCLISTEN=/usr/sbin/pppoe
#ALLOWPROCLISTEN=/usr/sbin/tcpdump
#ALLOWPROCLISTEN=/usr/sbin/snort-plain
#ALLOWPROCLISTEN=/sbin/dhclient3
#ALLOWPROCLISTEN=/sbin/dhcpcd

#
# SCAN_MODE_DEV governs how we scan /dev for suspicious files.
# The two allowed options are: THOROUGH or LAZY.
# If commented out we do a THOROUGH scan which will increase the runtime.
# Even though this adds to the running time it is highly recommended to
# leave it like this.
#
#SCAN_MODE_DEV=THOROUGH

#
# The PHALANX2_DIRTEST option is used to indicate if the Phalanx2 test is to
# perform a basic check, or a more thorough check. If the option is set to 0,
# then a basic check is performed. If it is set to 1, then all the directries
# in the /etc and /usr directories are scanned. The default value is 0. Users
# should note that setting this option to 1 will cause the test to take longer
# to complete.
#
#PHALANX2_DIRTEST=0

#
# Allow the specified files to be present in the /dev directory,
# and not regarded as suspicious. One file per line (use multiple
# ALLOWDEVFILE lines).
#
ALLOWDEVFILE=/dev/shm/network/ifstate
#ALLOWDEVFILE=/dev/abc
#ALLOWDEVFILE=/dev/shm/pulse-shm-*
#ALLOWDEVFILE=/dev/shm/sem.ADBE_ReadPrefs_*
#ALLOWDEVFILE=/dev/shm/sem.ADBE_REL_*
#ALLOWDEVFILE=/dev/shm/sem.ADBE_WritePrefs_*

#
# This setting tells rkhunter where the inetd configuration
# file is located.
#
#INETD_CONF_PATH=/etc/inetd.conf

#
# Allow the following enabled inetd services.
# Only one service per line (use multiple INETD_ALLOWED_SVC lines).
#
# For non-Solaris users the simple service name should be used.
# For example:
#
#     INETD_ALLOWED_SVC=echo
#
# For Solaris 9 users the simple service name should also be used, but
# if it is an RPC service, then the executable pathname should be used.
# For example:
#
#     INETD_ALLOWED_SVC=imaps
#     INETD_ALLOWED_SVC=/usr/sbin/rpc.metad
#     INETD_ALLOWED_SVC=/usr/sbin/rpc.metamhd
#
# For Solaris 10 users the service/FMRI name should be used. For example:
#
#     INETD_ALLOWED_SVC=/network/rpc/meta
#     INETD_ALLOWED_SVC=/network/rpc/metamed
#     INETD_ALLOWED_SVC=/application/font/stfsloader
#     INETD_ALLOWED_SVC=/network/rpc-100235_1/rpc_ticotsord
#
#INETD_ALLOWED_SVC=echo
#INETD_ALLOWED_SVC=/usr/sbin/tcpd

#
# This setting tells rkhunter where the xinetd configuration
# file is located.
#
#XINETD_CONF_PATH=/etc/xinetd.conf

#
# Allow the following enabled xinetd services. Whilst it would be
# nice to use the service names themselves, at the time of testing
# we only have the pathname available. As such, these entries are
# the xinetd file pathnames.
# Only one service (file) per line (use multiple XINETD_ALLOWED_SVC lines).
#
#XINETD_ALLOWED_SVC=/etc/xinetd.d/echo

#
# This option tells rkhunter the local system startup file pathnames.
# It is a space-separated list of files and directories. The directories
# will be searched for files. By default rkhunter will use certain
# filenames and directories. If the option is set to 'none', then
# certain tests will be skipped.
#
#STARTUP_PATHS="/etc/init.d /etc/rc.local"

#
# This setting tells rkhunter the pathname to the file containing the
# user account passwords. This setting will be worked out by rkhunter,
# and so should not usually need to be set. Users of TCB shadow files
# should not set this option.
#
#PASSWORD_FILE=/etc/shadow

#
# Allow the following accounts to be root equivalent. These accounts
# will have a UID value of zero. This option is a space-separated list
# of account names. The 'root' account does not need to be listed as it
# is automatically whitelisted.
#
# NOTE: For *BSD systems you may need to enable this for the 'toor' account.
#
#UID0_ACCOUNTS="toor rooty sashroot"

#
# Allow the following accounts to have no password. This option is a
# space-separated list of account names. NIS/YP entries do not need to
# be listed as they are automatically whitelisted.
#
#PWDLESS_ACCOUNTS="abc"

#
# This setting tells rkhunter the pathname to the syslog configuration
# file. This setting will be worked out by rkhunter, and so should not
# usually need to be set. A value of 'NONE' can be used to indicate
# that there is no configuration file, but that the syslog daemon process
# may be running.
#
#SYSLOG_CONFIG_FILE=/etc/syslog.conf

#
# This option permits the use of syslog remote logging.
#
ALLOW_SYSLOG_REMOTE_LOGGING=0

#
# Allow the following applications, or a specific version of an application,
# to be whitelisted. This option is a space-separated list consisting of the
# application names. If a specific version is to be whitelisted, then the
# name must be followed by a colon and then the version number.
#
# For example: APP_WHITELIST="openssl:0.9.7d gpg httpd:1.3.29"
#
# Note above that for the Apache web server, the name 'httpd' is used.
#
#APP_WHITELIST=""

# 
# Scan for suspicious files in directories containing temporary files and
# directories posing a relatively higher risk due to user write access.
# Please do not enable by default as suspscan is CPU and I/O intensive and prone to
# producing false positives. Do review all settings before usage.
# Also be aware that running suspscan in combination with verbose logging on,
# RKH's default, will show all ignored files.
# Please consider adding all directories the user the (web)server runs as has 
# write access to including the document root (example: "/var/www") and log
# directories (example: "/var/log/httpd"). 
#
# A space-separated list of directories to scan.
#
SUSPSCAN_DIRS="/tmp /var/tmp"

#
# Directory for temporary files. A memory-based one is better (faster).
# Do not use a directory name that is listed in SUSPSCAN_DIRS.
# Please make sure you have a tempfs mounted and the directory exists.
#
SUSPSCAN_TEMP=/dev/shm

#
# Maximum filesize in bytes. Files larger than this will not be inspected.
# Do make sure you have enough space left in your temporary files directory.
#
SUSPSCAN_MAXSIZE=10240000

#
# Score threshold. Below this value no hits will be reported.
# A value of "200" seems "good" after testing on malware. Please adjust
# locally if necessary. 
#
SUSPSCAN_THRESH=200

#
# The following option can be used to whitelist network ports which
# are known to have been used by malware. The option is a space-
# separated list of one or more of three types of whitelisting.
# These are:
#
#   1) a 'protocol:port' pair       (e.g. TCP:25)
#   2) a pathname to an executable  (e.g. /usr/sbin/squid)
#   3) an asterisk ('*')
#
# Only the UDP or TCP protocol may be specified, and the port number
# must be between 1 and 65535 inclusive.
#
# The asterisk can be used to indicate that any executable in a trusted
# path directory will be whitelisted. A trusted path directory is one which
# rkhunter uses to locate commands. It is composed of the root PATH
# environment variable, and the BINDIR command-line or configuration
# file option.
#
# For example: PORT_WHITELIST="/home/user1/abc /opt/xyz TCP:2001 UDP:32011"
#
#PORT_WHITELIST=""

#
# The following option can be used to tell rkhunter where the operating
# system 'release' file is located. This file contains information
# specifying the current O/S version. RKH will store this information
# itself, and check to see if it has changed between each run. If it has
# changed, then the user is warned that RKH may issue warning messages
# until RKH has been run with the '--propupd' option.
#
# Since the contents of the file vary according to the O/S distribution,
# RKH will perform different actions when it detects the file itself. As
# such, this option should not be set unless necessary. If this option is
# specified, then RKH will assume the O/S release information is on the
# first non-blank line of the file.
#
#OS_VERSION_FILE="/etc/debian_version"

#
# The following two options can be used to whitelist files and directories
# that would normally be flagged with a warning during the rootkit and
# malware checks. They are both space-separated lists, and as such if the
# file or directory name contains a space, then the percent character ('%')
# must be used instead. Only existing files and directories can be specified,
# and these must be full pathnames not links.
#
# NOTE: It is recommended that if you whitelist any files, then you include
# those files in the file properties check. See the USER_FILEPROP_FILES_DIRS
# configuration option.
#
#RTKT_DIR_WHITELIST=""
#RTKT_FILE_WHITELIST=""

#
# The following option can be used to whitelist shared library files that would
# normally be flagged with a warning during the preloaded shared library check.
# These library pathnames usually exist in the '/etc/ld.so.preload' file. This is
# a space-separated list of library pathnames.
#
# NOTE: It is recommended that if you whitelist any files, then you include
# those files in the file properties check. See the USER_FILEPROP_FILES_DIRS
# configuration option.
#
#SHARED_LIB_WHITELIST="/lib/snoopy.so"

#
# To force rkhunter to use the supplied script for the 'stat' or 'readlink'
# command, then the following two options can be used. The value must be
# set to 'BUILTIN'.
#
# NOTE: IRIX users will probably need to enable STAT_CMD.
#
#STAT_CMD=BUILTIN
#READLINK_CMD=BUILTIN

#
# In the file properties test any modification date/time is displayed as the
# number of epoch seconds. Rkhunter will try and use the 'date' command, or
# failing that the 'perl' command, to display the date and time in a
# human-readable format as well. This option may be used if some other command
# should be used instead. The given command must understand the '%s' and
# 'seconds ago' options found in the GNU date command.
#
# A value of 'NONE' may be used to request that only the epoch seconds be shown.
# A value of 'PERL' may be used to force rkhunter to use the 'perl' command, if
# it is present.
#
#EPOCH_DATE_CMD=""

#
# This setting tells rkhunter the directory containing the available
# kernel modules. This setting will be worked out by rkhunter, and
# so should not usually need to be set.
#
#MODULES_DIR=""

#
# The following option can be set to a command which rkhunter will use when
# downloading files from the Internet - that is, when the '--update' or
# '--versioncheck' option is used. The command can take options.
#
# This allows the user to use a command other than the one automatically
# selected by rkhunter, but still one which it already knows about.
#
# For example: WEBCMD=curl
#
# Alternatively, the user may specify a completely new command. However, note
# that rkhunter expects the downloaded file to be written to stdout, and that
# everything written to stderr is ignored.
#
# For example: WEBCMD="/opt/bin/dlfile --timeout 5m -q"
#
#WEBCMD=""

#
# Set the following option to 0 if you do not want to receive a warning if
# any O/S information has changed since the last run of 'rkhunter --propupd'.
# The warnings occur during the file properties check. The default is to
# issue a warning if something has changed.
#
#WARN_ON_OS_CHANGE=1

#
# Set the following option to 1 if you want rkhunter to automatically run
# a file properties update ('--propupd') if the O/S has changed. Detection
# of an O/S change occurs during the file properties check. The default is
# not to do an automatic update.
#
# WARNING: Only set this option if you are sure that the update will work
# correctly. That is, that the database directory is writeable, that a valid
# hash function is available, and so on. This can usually be checked simply
# by running 'rkhunter --propupd' at least once.
#
#UPDT_ON_OS_CHANGE=0

#
# Set the following option to 1 if locking is to be used when rkhunter runs.
# The lock is set just before logging starts, and is removed when the program
# ends. It is used to prevent items such as the log file, and the file
# properties file, from becoming corrupted if rkhunter is running more than
# once. The mechanism used is to simply create a lock file in the TMPDIR
# directory. If the lock file already exists, because rkhunter is already
# running, then the current process simply loops around sleeping for 10 seconds
# and then retrying the lock.
#
# The default is not to use locking.
#
USE_LOCKING=0

#
# If locking is used, then rkhunter may have to wait to get the lock file.
# This option sets the total amount of time, in seconds, that rkhunter should
# wait. It will retry the lock every 10 seconds, until either it obtains the
# lock or the timeout value has been reached. If no value is set, then a
# default of 300 seconds (5 minutes) is used.
#
LOCK_TIMEOUT=300

#
# If locking is used, then rkhunter may be doing nothing for some time if it
# has to wait for the lock. Some simple messages are echo'd to the users screen
# to let them know that rkhunter is waiting for the lock. Set this option to 0
# if the messages are not to be displayed. The default is to show them.
#
SHOW_LOCK_MSGS=1

#
# If the option SCANROOTKITMODE is set to "THOROUGH" the scanrootkit()  function
# will search (on a per rootkit basis) for filenames in all of the directories (as defined
# by the result of running 'find "${RKHROOTDIR}/" -xdev'). While still not optimal, as it 
# still searches for only file names as opposed to file contents, this is one step away
# from the rigidity of searching in known (evidence) or default (installation) locations.
#
# THIS OPTION SHOULD NOT BE ENABLED BY DEFAULT
# You should only activate this feature as part of a more thorough investigation which
# should be based on relevant best practices and procedures. 
# Enabling this feature implies you have the knowledge to interprete results properly. 
#
#SCANROOTKITMODE=THOROUGH

INSTALLDIR="/usr"