stretch.conf.j2 45 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264
  1. {% if ansible_controlled is defined and ansible_controlled != "" %}
  2. #
  3. # {{ ansible_controlled }}
  4. #
  5. {% endif %}
  6. #
  7. # This is the main configuration file for Rootkit Hunter.
  8. #
  9. # You can modify this file directly, or you can create a local configuration
  10. # file. The local file must be named 'rkhunter.conf.local', and must reside
  11. # in the same directory as this file. Alternatively you can create a directory,
  12. # named 'rkhunter.d', which also must be in the same directory as this
  13. # configuration file. Within the 'rkhunter.d' directory you can place further
  14. # configuration files. There is no restriction on the file names used, other
  15. # than they must end in '.conf'.
  16. #
  17. # Please modify the configuration file(s) to your own requirements. It is
  18. # recommended that the command 'rkhunter -C' is run after any changes have
  19. # been made.
  20. #
  21. # Please review the documentation before posting bug reports or questions.
  22. # To report bugs, obtain updates, or provide patches or comments, please go
  23. # to: http://rkhunter.sourceforge.net
  24. #
  25. # To ask questions about rkhunter, please use the 'rkhunter-users' mailing list.
  26. # Note that this is a moderated list, so please subscribe before posting.
  27. #
  28. # In the configuration files, lines beginning with a hash (#), and blank lines,
  29. # are ignored. Also, end-of-line comments are not supported.
  30. #
  31. # Any of the configuration options may appear more than once. However, several
  32. # options only take one value, and so the last one seen will be used. Some
  33. # options are allowed to appear more than once, and the text describing the
  34. # option will say if this is so. These configuration options will, in effect,
  35. # have their values concatenated together. To delete a previously specified
  36. # option list, specify the option with no value (that is, a null string).
  37. #
  38. # Some of the options are space-separated lists, others, typically those
  39. # specifying pathnames, are newline-separated lists. These must be entered
  40. # as one item per line. Quotes must not be used to surround the pathname.
  41. #
  42. # For example, to specify two pathnames, '/tmp/abc' and '/tmp/xyz', for an
  43. # option: XXX=/tmp/abc (correct)
  44. # XXX=/tmp/xyz
  45. #
  46. # XXX="/tmp/abc" (incorrect)
  47. # XXX="/tmp/xyz"
  48. #
  49. # XXX=/tmp/abc /tmp/xyz (incorrect)
  50. # or XXX="/tmp/abc /tmp/xyz" (incorrect)
  51. # or XXX="/tmp/abc" "/tmp/xyz" (incorrect)
  52. #
  53. # The last three examples are being configured as space-separated lists,
  54. # which is incorrect, generally, for options specifying pathnames. They
  55. # should be configured with one entry per line as in the first example.
  56. #
  57. # If wildcard characters (globbing) are allowed for an option, then the
  58. # text describing the option will say so.
  59. #
  60. # Space-separated lists may be enclosed by quotes, although they are not
  61. # required. If they are used, then they must only appear at the start and
  62. # end of the list, not in the middle.
  63. #
  64. # For example: XXX=abc def gh (correct)
  65. # XXX="abc def gh" (correct)
  66. # XXX="abc" "def" "gh" (incorrect)
  67. #
  68. # Space-separated lists may also be entered simply as one entry per line.
  69. #
  70. # For example: XXX=abc (correct)
  71. # XXX=def
  72. # XXX="gh"
  73. #
  74. # If a configuration option is never set, then the program will assume a
  75. # default value. The text describing the option will state the default value.
  76. # If there is no default, then rkhunter will calculate a value or pathname
  77. # to use.
  78. #
  79. #
  80. # If this option is set to '1', it specifies that the mirrors file
  81. # ('mirrors.dat'), which is used when the '--update' and '--versioncheck'
  82. # options are used, is to be rotated. Rotating the entries in the file allows
  83. # a basic form of load-balancing between the mirror sites whenever the above
  84. # options are used.
  85. #
  86. # If the option is set to '0', then the mirrors will be treated as if in a
  87. # priority list. That is, the first mirror listed will always be used first.
  88. # The second mirror will only be used if the first mirror fails, the third
  89. # mirror will only be used if the second mirror fails, and so on.
  90. #
  91. # If the mirrors file is read-only, then the '--versioncheck' command-line
  92. # option can only be used if this option is set to '0'.
  93. #
  94. # The default value is '1'.
  95. #
  96. #ROTATE_MIRRORS=1
  97. #
  98. # If this option is set to '1', it specifies that when the '--update' option is
  99. # used, then the mirrors file is to be checked for updates as well. If the
  100. # current mirrors file contains any local mirrors, these will be prepended to
  101. # the updated file. If this option is set to '0', the mirrors file can only be
  102. # updated manually. This may be useful if only using local mirrors.
  103. #
  104. # The default value is '1'.
  105. #
  106. #UPDATE_MIRRORS=1
  107. #
  108. # The MIRRORS_MODE option tells rkhunter which mirrors are to be used when
  109. # the '--update' or '--versioncheck' command-line options are given.
  110. # Possible values are:
  111. # 0 - use any mirror
  112. # 1 - only use local mirrors
  113. # 2 - only use remote mirrors
  114. #
  115. # Local and remote mirrors can be defined in the mirrors file by using the
  116. # 'local=' and 'remote=' keywords respectively.
  117. #
  118. # The default value is '0'.
  119. #
  120. #MIRRORS_MODE=0
  121. #
  122. # Email a message to this address if a warning is found when the system is
  123. # being checked. Multiple addresses may be specified simply be separating
  124. # them with a space. To disable the option, simply set it to the null string
  125. # or comment it out.
  126. #
  127. # The option may be specified more than once.
  128. #
  129. # The default value is the null string.
  130. #
  131. # Also see the MAIL_CMD option.
  132. #
  133. #MAIL-ON-WARNING=root
  134. #
  135. # This option specifies the mail command to use if MAIL-ON-WARNING is set.
  136. #
  137. # NOTE: Double quotes are not required around the command, but are required
  138. # around the subject line if it contains spaces.
  139. #
  140. # The default is to use the 'mail' command, with a subject line
  141. # of '[rkhunter] Warnings found for ${HOST_NAME}'.
  142. #
  143. #MAIL_CMD=mail -s "[rkhunter] Warnings found for ${HOST_NAME}"
  144. #
  145. # This option specifies the directory to use for temporary files.
  146. #
  147. # NOTE: Do not use '/tmp' as your temporary directory. Some important files
  148. # will be written to this directory, so be sure that the directory permissions
  149. # are secure.
  150. #
  151. # The installer program will set the default directory. If this default is
  152. # subsequently commented out or removed, then the program will assume a
  153. # default directory beneath the installation directory.
  154. #
  155. TMPDIR=/var/lib/rkhunter/tmp
  156. #
  157. # This option specifies the database directory to use.
  158. #
  159. # The installer program will set the default directory. If this default is
  160. # subsequently commented out or removed, then the program will assume a
  161. # default directory beneath the installation directory.
  162. #
  163. DBDIR=/var/lib/rkhunter/db
  164. #
  165. # This option specifies the script directory to use.
  166. #
  167. # The installer program will set the default directory. If this default is
  168. # subsequently commented out or removed, then the program will not run.
  169. #
  170. SCRIPTDIR=/usr/share/rkhunter/scripts
  171. #
  172. # This option can be used to modify the command directory list used by rkhunter
  173. # to locate commands (that is, its PATH). By default this will be the root PATH,
  174. # and an internal list of some common command directories.
  175. #
  176. # Any directories specified here will, by default, be appended to the default
  177. # list. However, if a directory name begins with the '+' character, then that
  178. # directory will be prepended to the list (that is, it will be put at the start
  179. # of the list).
  180. #
  181. # This is a space-separated list of directory names. The option may be
  182. # specified more than once.
  183. #
  184. # The default value is based on the root account PATH environment variable.
  185. #
  186. #BINDIR=/bin /usr/bin /sbin /usr/sbin
  187. #BINDIR=+/usr/local/bin +/usr/local/sbin
  188. #
  189. # This option specifies the default language to use. This should be similar to
  190. # the ISO 639 language code.
  191. #
  192. # NOTE: Please ensure that the language you specify is supported.
  193. # For a list of supported languages use the following command:
  194. #
  195. # rkhunter --lang en --list languages
  196. #
  197. # The default language is 'en' (English).
  198. #
  199. #LANGUAGE=en
  200. #
  201. # This option is a space-separated list of the languages that are to be updated
  202. # when the '--update' option is used. If unset, then all the languages will be
  203. # updated. If none of the languages are to be updated, then set this option to
  204. # just 'en'.
  205. #
  206. # The default language, specified by the LANGUAGE option, and the English (en)
  207. # language file will always be updated regardless of this option.
  208. #
  209. # This option may be specified more than once.
  210. #
  211. # The default value is the null string, indicating that all the language files
  212. # will be updated.
  213. #
  214. #UPDATE_LANG=""
  215. #
  216. # This option specifies the log file pathname. The file will be created if it
  217. # does not initially exist. If the option is unset, then the program will
  218. # display a message each time it is run saying that the default value is being
  219. # used.
  220. #
  221. # The default value is '/var/log/rkhunter.log'.
  222. #
  223. LOGFILE=/var/log/rkhunter.log
  224. #
  225. # Set this option to '1' if the log file is to be appended to whenever rkhunter
  226. # is run. A value of '0' will cause a new log file to be created whenever the
  227. # program is run.
  228. #
  229. # The default value is '0'.
  230. #
  231. #APPEND_LOG=0
  232. #
  233. # Set the following option to '1' if the log file is to be copied when rkhunter
  234. # finishes and an error or warning has occurred. The copied log file name will
  235. # be appended with the current date and time (in YYYY-MM-DD_HH:MM:SS format).
  236. # For example: rkhunter.log.2009-04-21_00:57:51
  237. # If the option value is '0', then the log file will not be copied regardless
  238. # of whether any errors or warnings occurred.
  239. #
  240. # The default value is '0'.
  241. #
  242. #COPY_LOG_ON_ERROR=0
  243. #
  244. # Set the following option to enable the rkhunter check start and finish times
  245. # to be logged by syslog. Warning messages will also be logged. The value of
  246. # the option must be a standard syslog facility and priority, separated by a
  247. # dot. For example:
  248. #
  249. # USE_SYSLOG=authpriv.warning
  250. #
  251. # Setting the value to 'none', or just leaving the option commented out,
  252. # disables the use of syslog.
  253. #
  254. # The default value is not to use syslog.
  255. #
  256. #USE_SYSLOG=authpriv.warning
  257. #
  258. # Set the following option to '1' if the second colour set is to be used. This
  259. # can be useful if your screen uses black characters on a white background
  260. # (for example, a PC instead of a server). A value of '0' will cause the default
  261. # colour set to be used.
  262. #
  263. # The default value is '0'.
  264. #
  265. #COLOR_SET2=0
  266. #
  267. # Set the following option to '0' if rkhunter should not detect if X is being
  268. # used. If X is detected as being used, then the second colour set will
  269. # automatically be used. If set to '1', then the use of X will be detected.
  270. #
  271. # The default value is '0'.
  272. #
  273. AUTO_X_DETECT=1
  274. #
  275. # Set the following option to '1' if it is wanted that any 'Whitelisted' results
  276. # are shown in white rather than green. For colour set 2 users, setting this
  277. # option will cause the result to be shown in black. Setting the option to '0'
  278. # causes whitelisted results to be displayed in green.
  279. #
  280. # The default value is '0'.
  281. #
  282. #WHITELISTED_IS_WHITE=0
  283. #
  284. # The following option is checked against the SSH configuration file
  285. # 'PermitRootLogin' option. A warning will be displayed if they do not match.
  286. # However, if a value has not been set in the SSH configuration file, then a
  287. # value here of 'unset' can be used to avoid warning messages.
  288. #
  289. # The default value is 'no'.
  290. #
  291. ALLOW_SSH_ROOT_USER=without-password
  292. #
  293. # Set this option to '1' to allow the use of the SSH-1 protocol, but note
  294. # that theoretically it is weaker, and therefore less secure, than the
  295. # SSH-2 protocol. Do not modify this option unless you have good reasons
  296. # to use the SSH-1 protocol (for instance for AFS token passing or Kerberos4
  297. # authentication). If the 'Protocol' option has not been set in the SSH
  298. # configuration file, then a value of '2' may be set here in order to
  299. # suppress a warning message. A value of '0' indicates that the use of
  300. # SSH-1 is not allowed.
  301. #
  302. # The default value is '0'.
  303. #
  304. #ALLOW_SSH_PROT_V1=0
  305. #
  306. # This setting tells rkhunter the directory containing the SSH configuration
  307. # file. This setting will be worked out by rkhunter, and so should not
  308. # usually need to be set.
  309. #
  310. # This option has no default value.
  311. #
  312. #SSH_CONFIG_DIR=/etc/ssh
  313. #
  314. # These two options determine which tests are to be performed. The ENABLE_TESTS
  315. # option can use the word 'all' to refer to all of the available tests. The
  316. # DISABLE_TESTS option can use the word 'none' to mean that no tests are
  317. # disabled. The list of disabled tests is applied to the list of enabled tests.
  318. #
  319. # Both options are space-separated lists of test names, and both options may
  320. # be specified more than once. The currently available test names can be seen
  321. # by using the command 'rkhunter --list tests'.
  322. #
  323. # The supplied configuration file has some tests already disabled, and these
  324. # are tests that will be used only occasionally, can be considered 'advanced'
  325. # or that are prone to produce more than the average number of false-positives.
  326. #
  327. # Please read the README file for more details about enabling and disabling
  328. # tests, the test names, and how rkhunter behaves when these options are used.
  329. #
  330. # The default values are to enable all tests and to disable none. However, if
  331. # either of the options below are specified, then they will override the
  332. # program defaults.
  333. #
  334. # hidden_procs test requires the unhide and/or unhide.rb commands which are
  335. # part of the unhide respectively unhide.rb packages in Debian.
  336. #
  337. # apps test is disabled by default as it triggers warnings about outdated
  338. # applications (and warns about possible security risk: we better trust
  339. # the Debian Security Team).
  340. #
  341. ENABLE_TESTS=all
  342. {% set disable_tests = [] %}
  343. {% if not ansible_virtualization_role is defined or ansible_virtualization_role != 'guest' %}
  344. {% if disable_tests.append('os_specific') %}{% endif %}
  345. {%- endif %}
  346. {% if not ansible_virtualization_role is defined or ansible_virtualization_role != 'host' %}
  347. {% if disable_tests.append('promisc') %}{% endif %}
  348. {%- endif %}
  349. DISABLE_TESTS=suspscan hidden_procs deleted_files packet_cap_apps apps {{ disable_tests|join(' ') }}
  350. #
  351. # The HASH_CMD option can be used to specify the command to use for the file
  352. # properties hash value check. It can be specified as just the command name or
  353. # the full pathname. If just the command name is given, and it is one of MD5,
  354. # SHA1, SHA224, SHA256, SHA384 or SHA512, then rkhunter will first look for the
  355. # relevant command, such as 'sha256sum', and then for 'sha256'. If neither of
  356. # these are found, it will then look to see if a perl module has been installed
  357. # which will support the relevant hash function. To see which perl modules have
  358. # been installed use the command 'rkhunter --list perl'.
  359. #
  360. # Systems using prelinking are restricted to using either the SHA1 or MD5
  361. # function.
  362. #
  363. # A value of 'NONE' (in uppercase) can be specified to indicate that no hash
  364. # function should be used. Rkhunter will detect this, and automatically disable
  365. # the file properties hash check test.
  366. #
  367. # Examples:
  368. # For Solaris 9 : HASH_CMD=gmd5sum
  369. # For Solaris 10: HASH_CMD=sha1sum
  370. # For AIX (>5.2): HASH_CMD="csum -hMD5"
  371. # For NetBSD : HASH_CMD="cksum -a sha512"
  372. #
  373. # NOTE: Whenever this option is changed 'rkhunter --propupd' must be run.
  374. #
  375. # The default value is the SHA1 function, or MD5 if SHA1 cannot be found.
  376. #
  377. # Also see the HASH_FLD_IDX option.
  378. #
  379. HASH_CMD=sha256sum
  380. #
  381. # The HASH_FLD_IDX option specifies which field from the HASH_CMD command
  382. # output contains the hash value. The fields are assumed to be space-separated.
  383. #
  384. # The option value must be an integer greater than zero.
  385. #
  386. # The default value is '1', but for *BSD users rkhunter will, by default, use a
  387. # value of '4' if the HASH_CMD option has not been set.
  388. #
  389. #HASH_FLD_IDX=4
  390. #
  391. # The PKGMGR option tells rkhunter to use the specified package manager to
  392. # obtain the file property information. This is used when updating the file
  393. # properties file ('rkhunter.dat'), and when running the file properties check.
  394. # For RedHat/RPM-based systems, 'RPM' can be used to get information from the
  395. # RPM database. For Debian-based systems 'DPKG' can be used, for *BSD systems
  396. # 'BSD' can be used, and for Solaris systems 'SOLARIS' can be used. No value,
  397. # or a value of 'NONE', indicates that no package manager is to be used.
  398. #
  399. # The current package managers, except 'SOLARIS', store the file hash values
  400. # using an MD5 hash function. The Solaris package manager includes a checksum
  401. # value, but this is not used by default (see USE_SUNSUM below).
  402. #
  403. # The 'DPKG' and 'BSD' package managers only provide MD5 hash values.
  404. # The 'RPM' package manager additionally provides values for the inode,
  405. # file permissions, uid, gid and other values. The 'SOLARIS' also provides
  406. # most of the values, similar to 'RPM', but not the inode number.
  407. #
  408. # For any file not part of a package, rkhunter will revert to using the
  409. # HASH_CMD hash function instead.
  410. #
  411. # NOTE: Whenever this option is changed 'rkhunter --propupd' must be run.
  412. #
  413. # The default value is 'NONE'.
  414. #
  415. # Also see the PKGMGR_NO_VRFY and USE_SUNSUM options.
  416. #
  417. # NONE is the default for Debian as well, as running --propupd takes
  418. # about 4 times longer when it's set to DPKG
  419. #
  420. #PKGMGR=NONE
  421. #
  422. # It is possible that a file, which is part of a package, may have been
  423. # modified by the administrator. Typically this occurs for configuration
  424. # files. However, the package manager may list the file as being modified.
  425. # For the RPM package manager this may well depend on how the package was
  426. # built. This option specifies a pathname which is to be exempt from the
  427. # package manager verification process, and which will be treated
  428. # as a non-packaged file. As such, the file properties are still checked.
  429. #
  430. # This option only takes effect if the PKGMGR option has been set, and
  431. # is not 'NONE'.
  432. #
  433. # This option may be specified more than once.
  434. #
  435. # NOTE: Whenever this option is changed 'rkhunter --propupd' must be run.
  436. #
  437. # The default value is the null string.
  438. #
  439. #PKGMGR_NO_VRFY=""
  440. #
  441. # If the 'SOLARIS' package manager is used, then it is possible to use the
  442. # checksum (hash) value stored for a file. However, this is only a 16-bit
  443. # checksum, and as such is not nearly as secure as, for example, a SHA-2 value.
  444. # If the option is set to '0', then the checksum is not used and the hash
  445. # function given by HASH_CMD is used instead. To enable this option, set its
  446. # value to '1'. The Solaris 'sum' command must be present on the system if this
  447. # option is used.
  448. #
  449. # The default value is '0'.
  450. #
  451. #USE_SUNSUM=0
  452. #
  453. # This option can be used to tell rkhunter to ignore any prelink dependency
  454. # errors for the given commands. However, a warning will also be issued if the
  455. # error does not occur for a given command. As such this option must only be
  456. # used on commands which experience a persistent problem.
  457. #
  458. # Short-term prelink dependency errors can usually be resolved simply by
  459. # running the 'prelink' command on the given pathname.
  460. #
  461. # This is a space-separated list of command pathnames. The option can be
  462. # specified more than once.
  463. #
  464. # NOTE: Whenever this option is changed 'rkhunter --propupd' must be run.
  465. #
  466. # The default value is the null string.
  467. #
  468. #IGNORE_PRELINK_DEP_ERR=/bin/ps /usr/bin/top
  469. #
  470. # These options specify a command, directory or file pathname which will be
  471. # included or excluded in the file properties checks.
  472. #
  473. # For the USER_FILEPROP_FILES_DIRS option, simple command names - for example,
  474. # 'top' - and directory names are added to the internal list of directories to
  475. # be searched for each of the command names in the command list. Additionally,
  476. # full pathnames to files, which need not be commands, may be given. Any files
  477. # or directories which are already part of the internal lists will be silently
  478. # ignored from the configuration.
  479. #
  480. # For the USER_FILEPROP_FILES_DIRS option, wildcards are allowed, except for
  481. # simple command names.
  482. # For example, 'top*' cannot be given, but '/usr/bin/top*' is allowed.
  483. #
  484. # Specific files may be excluded by using the EXCLUDE_USER_FILEPROP_FILES_DIRS
  485. # option. Wildcards may be used with this option.
  486. #
  487. # By combining these two options, and using wildcards, whole directories can be
  488. # excluded. For example:
  489. #
  490. # USER_FILEPROP_FILES_DIRS=/etc/*
  491. # USER_FILEPROP_FILES_DIRS=/etc/*/*
  492. # EXCLUDE_USER_FILEPROP_FILES_DIRS=/etc/rc?.d/*
  493. #
  494. # This will look for files in the first two directory levels of '/etc'. However,
  495. # anything in '/etc/rc0.d', '/etc/rc1.d', '/etc/rc2.d' and so on, will be
  496. # excluded.
  497. #
  498. # NOTE: Only files and directories which have been added by the user, and are
  499. # not part of the internal lists, can be excluded. So, for example, it is not
  500. # possible to exclude the 'ps' command by using '/bin/ps'. These will be
  501. # silently ignored from the configuration.
  502. #
  503. # Both options can be specified more than once.
  504. #
  505. # NOTE: Whenever these options are changed 'rkhunter --propupd' must be run.
  506. #
  507. # The default value for both options is the null string.
  508. #
  509. #USER_FILEPROP_FILES_DIRS=top
  510. #USER_FILEPROP_FILES_DIRS=/usr/local/sbin
  511. #USER_FILEPROP_FILES_DIRS=/etc/rkhunter.conf
  512. #USER_FILEPROP_FILES_DIRS=/etc/rkhunter.conf.local
  513. #USER_FILEPROP_FILES_DIRS=/var/lib/rkhunter/db/*
  514. #USER_FILEPROP_FILES_DIRS=/var/lib/rkhunter/db/i18n/*
  515. #EXCLUDE_USER_FILEPROP_FILES_DIRS=/opt/ps*
  516. #EXCLUDE_USER_FILEPROP_FILES_DIRS=/var/lib/rkhunter/db/mirrors.dat
  517. #EXCLUDE_USER_FILEPROP_FILES_DIRS=/var/lib/rkhunter/db/rkhunter*
  518. #
  519. # This option whitelists files and directories from existing, or not existing,
  520. # on the system at the time of testing. This option is used when the
  521. # configuration file options themselves are checked, and during the file
  522. # properties check, the hidden files and directories checks, and the filesystem
  523. # check of the '/dev' directory.
  524. #
  525. # This option may be specified more than once, and may use wildcards.
  526. # Be aware though that this is probably not what you want to do as the
  527. # wildcarding will be expanded after files have been deleted. As such
  528. # deleted files won't be whitelisted if wildcarded.
  529. #
  530. # NOTE: The user must take into consideration how often the file will appear
  531. # and disappear from the system in relation to how often rkhunter is run. If
  532. # the file appears, and disappears, too often then rkhunter may not notice
  533. # this. All it will see is that the file has changed. The inode-number and DTM
  534. # will certainly be different for each new file, and rkhunter will report this.
  535. #
  536. # The default value is the null string.
  537. #
  538. #EXISTWHITELIST=""
  539. #
  540. # Whitelist various attributes of the specified file. The attributes are those
  541. # of the 'attributes' test. Specifying a file name here does not include it
  542. # being whitelisted for the write permission test (see below).
  543. #
  544. # This option may be specified more than once, and may use wildcard characters.
  545. #
  546. # The default value is the null string.
  547. #
  548. #ATTRWHITELIST=/usr/bin/date
  549. #
  550. # Allow the specified file to have the 'others' (world) permission have the
  551. # write-bit set. For example, files with permissions r-xr-xrwx or rwxrwxrwx.
  552. #
  553. # This option may be specified more than once, and may use wildcard characters.
  554. #
  555. # The default value is the null string.
  556. #
  557. #WRITEWHITELIST=/usr/bin/date
  558. #
  559. # Allow the specified file to be a script.
  560. #
  561. # This option may be specified more than once, and may use wildcard characters.
  562. #
  563. # The default value is the null string.
  564. #
  565. SCRIPTWHITELIST=/bin/egrep
  566. SCRIPTWHITELIST=/bin/fgrep
  567. SCRIPTWHITELIST=/bin/which
  568. SCRIPTWHITELIST=/usr/bin/ldd
  569. #SCRIPTWHITELIST=/usr/bin/lwp-request
  570. SCRIPTWHITELIST=/usr/sbin/adduser
  571. #SCRIPTWHITELIST=/usr/sbin/prelink
  572. #SCRIPTWHITELIST=/usr/sbin/unhide.rb
  573. #
  574. # Allow the specified file to have the immutable attribute set.
  575. #
  576. # This option may be specified more than once, and may use wildcard characters.
  577. #
  578. # The default value is the null string.
  579. #
  580. #IMMUTWHITELIST=/sbin/ifdown
  581. #
  582. # If this option is set to '1', then the immutable-bit test is reversed. That
  583. # is, the files are expected to have the bit set. A value of '0' means that the
  584. # immutable-bit should not be set.
  585. #
  586. # The default value is '0'.
  587. #
  588. #IMMUTABLE_SET=0
  589. #
  590. # Allow the specified hidden directory to be whitelisted.
  591. #
  592. # This option may be specified more than once, and may use wildcard characters.
  593. #
  594. # The default value is the null string.
  595. #
  596. ALLOWHIDDENDIR=/etc/.java
  597. ALLOWHIDDENDIR=/etc/.git
  598. #ALLOWHIDDENDIR=/dev/.lxc
  599. #
  600. # Allow the specified hidden file to be whitelisted.
  601. #
  602. # This option may be specified more than once, and may use wildcard characters.
  603. #
  604. # The default value is the null string.
  605. #
  606. #ALLOWHIDDENFILE=/usr/share/man/man1/..1.gz
  607. #ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac
  608. #ALLOWHIDDENFILE=/usr/bin/.ssh.hmac
  609. #ALLOWHIDDENFILE=/usr/lib/.libfipscheck.so.1.1.0.hmac
  610. #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
  611. #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
  612. #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
  613. #ALLOWHIDDENFILE=/usr/share/man/man5/.k5login.5.gz
  614. #ALLOWHIDDENFILE=/usr/share/man/man5/.k5identity.5.gz
  615. ALLOWHIDDENFILE=/etc/.gitignore
  616. #ALLOWHIDDENFILE=/etc/.bzrignore
  617. ALLOWHIDDENFILE=/etc/.etckeeper
  618. #
  619. # Allow the specified process to use deleted files. The process name may be
  620. # followed by a colon-separated list of full pathnames. The process will then
  621. # only be whitelisted if it is using one of the given files. For example:
  622. #
  623. # ALLOWPROCDELFILE=/usr/libexec/gconfd-2:/tmp/abc:/var/tmp/xyz
  624. #
  625. # This option may be specified more than once. It may also use wildcards, but
  626. # only in the file names.
  627. #
  628. # The default value is the null string.
  629. #
  630. #ALLOWPROCDELFILE=/sbin/cardmgr
  631. #ALLOWPROCDELFILE=/usr/lib/libgconf2-4/gconfd-2
  632. #ALLOWPROCDELFILE=/usr/sbin/mysqld:/tmp/ib*
  633. #ALLOWPROCDELFILE=/usr/lib/iceweasel/iceweasel
  634. #ALLOWPROCDELFILE=/usr/bin/file-roller
  635. #
  636. # Allow the specified process to listen on any network interface.
  637. #
  638. # This option may be specified more than once, and may use wildcard characters.
  639. #
  640. # The default value is the null string.
  641. #
  642. #ALLOWPROCLISTEN=/sbin/dhclient
  643. #ALLOWPROCLISTEN=/usr/bin/dhcpcd
  644. #ALLOWPROCLISTEN=/usr/sbin/tcpdump
  645. #ALLOWPROCLISTEN=/usr/sbin/snort-plain
  646. #
  647. # Allow the specified network interfaces to be in promiscuous mode.
  648. #
  649. # This is a space-separated list of interface names. The option may be
  650. # specified more than once.
  651. #
  652. # The default value is the null string.
  653. #
  654. #ALLOWPROMISCIF=eth0
  655. #
  656. # This option specifies how rkhunter should scan the '/dev' directory for
  657. # suspicious files. The only allowed values are 'THOROUGH' and 'LAZY'.
  658. #
  659. # A THOROUGH scan will increase the overall runtime of rkhunter. Despite this,
  660. # it is highly recommended that this value is used.
  661. #
  662. # The default value is 'THOROUGH'.
  663. #
  664. # Also see the ALLOWDEVFILE option.
  665. #
  666. #SCAN_MODE_DEV=THOROUGH
  667. #
  668. # Allow the specified file to be present in the '/dev' directory, and not
  669. # regarded as suspicious.
  670. #
  671. # This option may be specified more than once, and may use wildcard characters.
  672. #
  673. # The default value is the null string.
  674. #
  675. #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  676. #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
  677. ALLOWDEVFILE=/dev/shm/PostgreSQL.*
  678. #
  679. # This option is used to indicate if the Phalanx2 test is to perform a basic
  680. # check, or a more thorough check. If the option is set to '0', then a basic
  681. # check is performed. If it is set to '1', then all the directories in the
  682. # '/etc' and '/usr' directories are scanned.
  683. #
  684. # NOTE: Setting this option to '1' will cause the test to take longer
  685. # to complete.
  686. #
  687. # The default value is '0'.
  688. #
  689. #PHALANX2_DIRTEST=0
  690. #
  691. # This option tells rkhunter where the inetd configuration file is located.
  692. #
  693. # The default value is the null string.
  694. #
  695. #INETD_CONF_PATH=/etc/inetd.conf
  696. #
  697. # This option allows the specified enabled inetd services.
  698. #
  699. # This is a space-separated list of service names. The option may be specified
  700. # more than once.
  701. #
  702. # For non-Solaris users the simple service name should be used.
  703. # For example:
  704. #
  705. # INETD_ALLOWED_SVC=echo
  706. #
  707. # For Solaris 9 users the simple service name should also be used, but
  708. # if it is an RPC service, then the executable pathname should be used.
  709. # For example:
  710. #
  711. # INETD_ALLOWED_SVC=imaps
  712. # INETD_ALLOWED_SVC=/usr/sbin/rpc.metad /usr/sbin/rpc.metamhd
  713. #
  714. # For Solaris 10 users the service/FMRI name should be used. For example:
  715. #
  716. # INETD_ALLOWED_SVC=/network/rpc/meta
  717. # INETD_ALLOWED_SVC=/network/rpc/metamed
  718. # INETD_ALLOWED_SVC=/application/font/stfsloader
  719. # INETD_ALLOWED_SVC=/network/rpc-100235_1/rpc_ticotsord
  720. #
  721. # The default value is the null string.
  722. #
  723. #INETD_ALLOWED_SVC=echo
  724. #
  725. # This option tells rkhunter where the xinetd configuration file is located.
  726. #
  727. # The default value is the null string.
  728. #
  729. #XINETD_CONF_PATH=/etc/xinetd.conf
  730. #
  731. # This option allows the specified enabled xinetd services. Whilst it would be
  732. # nice to use the service names themselves, at the time of testing we only have
  733. # the pathname available. As such, these entries are the xinetd file pathnames.
  734. #
  735. # This is a space-separated list of service names. The option may be specified
  736. # more than once.
  737. #
  738. # The default value is the null string.
  739. #
  740. #XINETD_ALLOWED_SVC=/etc/xinetd.d/echo
  741. #
  742. # This option tells rkhunter the local system startup file pathnames. The
  743. # directories will be searched for files. By default rkhunter will try and
  744. # determine were the startup files are located. If the option is set to 'NONE',
  745. # then certain tests will be skipped.
  746. #
  747. # This is a space-separated list of file and directory pathnames. The option
  748. # may be specified more than once, and may use wildcard characters.
  749. #
  750. # This option has no default value.
  751. #
  752. #STARTUP_PATHS=/etc/init.d /etc/rc.local
  753. #
  754. # This option tells rkhunter the pathname to the file containing the user
  755. # account passwords. This setting will be worked out by rkhunter, and so
  756. # should not usually need to be set. Users of TCB shadow files should not
  757. # set this option.
  758. #
  759. # This option has no default value.
  760. #
  761. #PASSWORD_FILE=/etc/shadow
  762. #
  763. # This option allows the specified accounts to be root equivalent. These
  764. # accounts will have a UID value of zero. The 'root' account does not need
  765. # to be listed as it is automatically whitelisted.
  766. #
  767. # This is a space-separated list of account names. The option may be specified
  768. # more than once.
  769. #
  770. # NOTE: For *BSD systems you will probably need to use this option for the
  771. # 'toor' account.
  772. #
  773. # The default value is the null string.
  774. #
  775. #UID0_ACCOUNTS=toor rooty sashroot
  776. #
  777. # This option allows the specified accounts to have no password. NIS/YP entries
  778. # do not need to be listed as they are automatically whitelisted.
  779. #
  780. # This is a space-separated list of account names. The option may be specified
  781. # more than once.
  782. #
  783. # The default value is the null string.
  784. #
  785. #PWDLESS_ACCOUNTS=abc
  786. #
  787. # This option tells rkhunter the pathname to the syslog configuration file.
  788. # This setting will be worked out by rkhunter, and so should not usually need
  789. # to be set. A value of 'NONE' can be used to indicate that there is no
  790. # configuration file, but that the syslog daemon process may be running.
  791. #
  792. # This is a space-separated list of pathnames. The option may be specified
  793. # more than once.
  794. #
  795. # This option has no default value.
  796. #
  797. #SYSLOG_CONFIG_FILE=/etc/syslog.conf
  798. #
  799. # If this option is set to '1', then the use of syslog remote logging is
  800. # permitted. A value of '0' disallows the use of remote logging.
  801. #
  802. # The default value is '0'.
  803. #
  804. #ALLOW_SYSLOG_REMOTE_LOGGING=0
  805. #
  806. # This option allows the specified applications, or a specific version of an
  807. # application, to be whitelisted. If a specific version is to be whitelisted,
  808. # then the name must be followed by a colon and then the version number.
  809. # For example:
  810. #
  811. # APP_WHITELIST=openssl:0.9.7d gpg httpd:1.3.29
  812. #
  813. # This is a space-separated list of pathnames. The option may be specified
  814. # more than once.
  815. #
  816. # The default value is the null string.
  817. #
  818. #APP_WHITELIST=""
  819. #
  820. # Set this option to scan for suspicious files in directories which pose a
  821. # relatively higher risk due to user write access.
  822. #
  823. # Please do not enable the 'suspscan' test by default as it is CPU and I/O
  824. # intensive, and prone to producing false positives. Do review all settings
  825. # before usage. Also be aware that running 'suspscan' in combination with
  826. # verbose logging on, rkhunter's default, will show all ignored files.
  827. #
  828. # Please consider adding all directories the user the (web)server runs as,
  829. # and has write access to, including the document root (e.g: '/var/www') and
  830. # log directories (e.g: '/var/log/httpd').
  831. #
  832. # This is a space-separated list of directory pathnames. The option may be
  833. # specified more than once.
  834. #
  835. # The default value is the '/tmp' and '/var/tmp' directories.
  836. #
  837. #SUSPSCAN_DIRS=/tmp /var/tmp
  838. #
  839. # This option specifies the directory for temporary files used by the
  840. # 'suspscan' test. A memory-based directory, such as a tempfs filesystem, is
  841. # better (faster). Do not use a directory name that is listed in SUSPSCAN_DIRS
  842. # as that is highly likely to cause false-positive results.
  843. #
  844. # The default value is '/dev/shm'.
  845. #
  846. #SUSPSCAN_TEMP=/dev/shm
  847. #
  848. # This option specifies the 'suspscan' test maximum filesize in bytes. Files
  849. # larger than this will not be inspected. Do make sure you have enough space
  850. # available in your temporary files directory.
  851. #
  852. # The default value is '1024000'.
  853. #
  854. #SUSPSCAN_MAXSIZE=10240000
  855. #
  856. # This option specifies the 'suspscan' test score threshold. Below this value
  857. # no hits will be reported.
  858. #
  859. # The default value is '200'.
  860. #
  861. #SUSPSCAN_THRESH=200
  862. #
  863. # The following options can be used to whitelist network ports which are known
  864. # to have been used by malware.
  865. #
  866. # The PORT_WHITELIST option is a space-separated list of one or more of two
  867. # types of whitelisting. These are:
  868. #
  869. # 1) a 'protocol:port' pair
  870. # 2) an asterisk ('*')
  871. #
  872. # Only the UDP or TCP protocol may be specified, and the port number must be
  873. # between 1 and 65535 inclusive.
  874. #
  875. # The asterisk can be used to indicate that any executable which rkhunter can
  876. # locate as a command, is whitelisted. (Also see BINDIR)
  877. #
  878. # The PORT_PATH_WHITELIST option specifies one of two types of whitelisting.
  879. # These are:
  880. #
  881. # 1) a pathname to an executable
  882. # 2) a combined pathname, protocol and port
  883. #
  884. # As above, the protocol can only be TCP or UDP, and the port number must be
  885. # between 1 and 65535 inclusive.
  886. #
  887. # Examples:
  888. #
  889. # PORT_WHITELIST=TCP:2001 UDP:32011
  890. # PORT_PATH_WHITELIST=/usr/sbin/squid
  891. # PORT_PATH_WHITELIST=/usr/sbin/squid:TCP:3801
  892. #
  893. # NOTE: In order to whitelist a pathname, or use the asterisk option, the
  894. # 'lsof' command must be present.
  895. #
  896. # Both options may be specified more than once.
  897. #
  898. # The default value for both options is the null string.
  899. #
  900. #PORT_WHITELIST=""
  901. #PORT_PATH_WHITELIST=""
  902. #
  903. # The following option can be used to tell rkhunter where the operating system
  904. # 'release' file is located. This file contains information specifying the
  905. # current O/S version. RKH will store this information, and check to see if it
  906. # has changed between each run. If it has changed, then the user is warned that
  907. # RKH may issue warning messages until RKH has been run with the '--propupd'
  908. # option.
  909. #
  910. # Since the contents of the file vary according to the O/S distribution, RKH
  911. # will perform different actions when it detects the file itself. As such, this
  912. # option should not be set unless necessary. If this option is specified, then
  913. # RKH will assume the O/S release information is on the first non-blank line of
  914. # the file.
  915. #
  916. # This option has no default value.
  917. #
  918. # Also see the WARN_ON_OS_CHANGE and UPDT_ON_OS_CHANGE options.
  919. #
  920. #OS_VERSION_FILE=/etc/debian_version
  921. #
  922. # Set the following option to '0' if you do not want to receive a warning if any
  923. # O/S information has changed since the last run of 'rkhunter --propupd'. The
  924. # warnings occur during the file properties check. Setting a value of '1' will
  925. # cause rkhunter to issue a warning if something has changed.
  926. #
  927. # The default value is '1'.
  928. #
  929. #WARN_ON_OS_CHANGE=1
  930. #
  931. # Set the following option to '1' if you want rkhunter to automatically run a
  932. # file properties update ('--propupd') if the O/S has changed. Detection of an
  933. # O/S change occurs during the file properties check. Setting a value of '0'
  934. # will cause rkhunter not to do an automatic update.
  935. #
  936. # WARNING: Only set this option if you are sure that the update will work
  937. # correctly. That is, that the database directory is writeable, that a valid
  938. # hash function is available, and so on. This can usually be checked simply by
  939. # running 'rkhunter --propupd' at least once.
  940. #
  941. # The default value is '0'.
  942. #
  943. #UPDT_ON_OS_CHANGE=0
  944. #
  945. # The following two options can be used to whitelist files and directories that
  946. # would normally be flagged with a warning during the various rootkit and
  947. # malware checks. Only existing files and directories can be specified, and
  948. # these must be full pathnames not links.
  949. #
  950. # Additionally, the RTKT_FILE_WHITELIST option may include a string after the
  951. # file name (separated by a colon). This will then only whitelist that string
  952. # in that file (as part of the malware checks). For example:
  953. #
  954. # RTKT_FILE_WHITELIST=/etc/rc.local:hdparm
  955. #
  956. # If the option list includes the filename on its own as well, then the file
  957. # will be whitelisted from rootkit checks of the files existence, but still
  958. # only the specific string within the file will be whitelisted. For example:
  959. #
  960. # RTKT_FILE_WHITELIST=/etc/rc.local
  961. # RTKT_FILE_WHITELIST=/etc/rc.local:hdparm
  962. #
  963. # To whitelist a file from the existence checks, but not from the strings
  964. # checks, then include the filename on its own and on its own but with just
  965. # a colon appended. For example:
  966. #
  967. # RTKT_FILE_WHITELIST=/etc/rc.local
  968. # RTKT_FILE_WHITELIST=/etc/rc.local:
  969. #
  970. # NOTE: It is recommended that if you whitelist any files, then you include
  971. # those files in the file properties check. See the USER_FILEPROP_FILES_DIRS
  972. # configuration option.
  973. #
  974. # Both of these options may be specified more than once.
  975. #
  976. # For both options the default value is the null string.
  977. #
  978. #RTKT_DIR_WHITELIST=""
  979. #RTKT_FILE_WHITELIST=""
  980. #
  981. # The following option can be used to whitelist shared library files that would
  982. # normally be flagged with a warning during the preloaded shared library check.
  983. # These library pathnames usually exist in the '/etc/ld.so.preload' file or in
  984. # the LD_PRELOAD environment variable.
  985. #
  986. # NOTE: It is recommended that if you whitelist any files, then you include
  987. # those files in the file properties check. See the USER_FILEPROP_FILES_DIRS
  988. # configuration option.
  989. #
  990. # This option is a space-separated list of library pathnames. The option may be
  991. # specified more than once.
  992. #
  993. # The default value is the null string.
  994. #
  995. #SHARED_LIB_WHITELIST=/lib/snoopy.so
  996. #
  997. # To force rkhunter to use the supplied script for the 'stat' or 'readlink'
  998. # command the following two options can be used. The value must be set to
  999. # 'BUILTIN'.
  1000. #
  1001. # NOTE: IRIX users will probably need to enable STAT_CMD.
  1002. #
  1003. # For both options the default value is the null string.
  1004. #
  1005. #STAT_CMD=BUILTIN
  1006. #READLINK_CMD=BUILTIN
  1007. #
  1008. # In the file properties test any modification date/time is displayed as the
  1009. # number of epoch seconds. Rkhunter will try and use the 'date' command, or
  1010. # failing that the 'perl' command, to display the date and time in a
  1011. # human-readable format as well. This option may be used if some other command
  1012. # should be used instead. The given command must understand the '%s' and
  1013. # 'seconds ago' options found in the GNU 'date' command.
  1014. #
  1015. # A value of 'NONE' may be used to request that only the epoch seconds be shown.
  1016. # A value of 'PERL' may be used to force rkhunter to use the 'perl' command, if
  1017. # it is present.
  1018. #
  1019. # This option has no default value.
  1020. #
  1021. #EPOCH_DATE_CMD=""
  1022. #
  1023. # This setting tells rkhunter the directory containing the available Linux
  1024. # kernel modules. This setting will be worked out by rkhunter, and so should
  1025. # not usually need to be set.
  1026. #
  1027. # This option has no default value.
  1028. #
  1029. #MODULES_DIR=""
  1030. #
  1031. # The following option can be set to a command which rkhunter will use when
  1032. # downloading files from the Internet - that is, when the '--update' or
  1033. # '--versioncheck' option is used. The command can take options.
  1034. #
  1035. # This allows the user to use a command other than the one automatically
  1036. # selected by rkhunter, but still one which it already knows about.
  1037. # For example:
  1038. #
  1039. # WEB_CMD=curl
  1040. #
  1041. # Alternatively, the user may specify a completely new command. However, note
  1042. # that rkhunter expects the downloaded file to be written to stdout, and that
  1043. # everything written to stderr is ignored. For example:
  1044. #
  1045. # WEB_CMD="/opt/bin/dlfile --timeout 5m -q"
  1046. #
  1047. # *BSD users may want to use the 'ftp' command, provided that it supports the
  1048. # HTTP protocol:
  1049. #
  1050. # WEB_CMD="ftp -o -"
  1051. #
  1052. # This option has no default value.
  1053. #
  1054. #WEB_CMD=""
  1055. #
  1056. # Set the following option to '1' if locking is to be used when rkhunter runs.
  1057. # The lock is set just before logging starts, and is removed when the program
  1058. # ends. It is used to prevent items such as the log file, and the file
  1059. # properties file, from becoming corrupted if rkhunter is running more than
  1060. # once. The mechanism used is to simply create a lock file in the TMPDIR
  1061. # directory. If the lock file already exists, because rkhunter is already
  1062. # running, then the current process simply loops around sleeping for 10 seconds
  1063. # and then retrying the lock. A value of '0' means not to use locking.
  1064. #
  1065. # The default value is '0'.
  1066. #
  1067. # Also see the LOCK_TIMEOUT and SHOW_LOCK_MSGS options.
  1068. #
  1069. #USE_LOCKING=0
  1070. #
  1071. # If locking is used, then rkhunter may have to wait to get the lock file.
  1072. # This option sets the total amount of time, in seconds, that rkhunter should
  1073. # wait. It will retry the lock every 10 seconds, until either it obtains the
  1074. # lock or the timeout value has been reached.
  1075. #
  1076. # The default value is 300 seconds (5 minutes).
  1077. #
  1078. #LOCK_TIMEOUT=300
  1079. #
  1080. # If locking is used, then rkhunter may be doing nothing for some time if it
  1081. # has to wait for the lock. If this option is set to '1', then some simple
  1082. # messages are echoed to the users screen to let them know that rkhunter is
  1083. # waiting for the lock. Set this option to '0' if the messages are not to be
  1084. # displayed.
  1085. #
  1086. # The default value is '1'.
  1087. #
  1088. #SHOW_LOCK_MSGS=1
  1089. #
  1090. # If this option is set to 'THOROUGH' then rkhunter will search (on a per
  1091. # rootkit basis) for filenames in all of the directories (as defined by the
  1092. # result of running 'find / -xdev'). While still not optimal, as it still
  1093. # searches for only file names as opposed to file contents, this is one step
  1094. # away from the rigidity of searching in known (evidence) or default
  1095. # (installation) locations.
  1096. #
  1097. # THIS OPTION SHOULD NOT BE ENABLED BY DEFAULT.
  1098. #
  1099. # You should only activate this feature as part of a more thorough
  1100. # investigation, which should be based on relevant best practices and
  1101. # procedures.
  1102. #
  1103. # Enabling this feature implies you have the knowledge to interpret the
  1104. # results properly.
  1105. #
  1106. # The default value is the null string.
  1107. #
  1108. #SCANROOTKITMODE=THOROUGH
  1109. #
  1110. # The following option can be set to the name(s) of the tests the 'unhide'
  1111. # command is to use. Options such as '-m' and '-v' may be specified, but will
  1112. # only take effect when they are seen. The test names are a space-separated
  1113. # list, and will be executed in the order given.
  1114. #
  1115. # This option may be specified more than once.
  1116. #
  1117. # The default value is 'sys' in order to maintain compatibility with older
  1118. # versions of 'unhide'.
  1119. #
  1120. #UNHIDE_TESTS=sys
  1121. #
  1122. # The following option can be used to set options for the 'unhide-tcp' command.
  1123. # The options are space-separated.
  1124. #
  1125. # This option may be specified more than once.
  1126. #
  1127. # The default value is the null string.
  1128. #
  1129. #UNHIDETCP_OPTS=""
  1130. #
  1131. # If both the C 'unhide', and Ruby 'unhide.rb', programs exist on the system,
  1132. # then it is possible to disable the execution of one of the programs if
  1133. # desired. By default rkhunter will look for both programs, and execute each
  1134. # of them as they are found. If the value of this option is '0', then both
  1135. # programs will be executed if they are present. A value of '1' will disable
  1136. # execution of the C 'unhide' program, and a value of '2' will disable the Ruby
  1137. # 'unhide.rb' program. To disable both programs, then disable the
  1138. # 'hidden_procs' test.
  1139. #
  1140. # The default value is '0'.
  1141. #
  1142. DISABLE_UNHIDE=0
  1143. INSTALLDIR=/usr
  1144. #
  1145. # This option can be set to either '0' or '1'. If set to '1' then the summary,
  1146. # shown after rkhunter has run, will display the actual number of warnings
  1147. # found. If it is set to '0', then the summary will simply indicate that
  1148. # 'One or more' warnings were found. If no warnings were found, and this option
  1149. # is set to '1', then a "0" will be shown. If the option is set to '0', then
  1150. # the words 'No warnings' will be shown.
  1151. #
  1152. # The default value is '0'.
  1153. #
  1154. #SHOW_SUMMARY_WARNINGS_NUMBER=0
  1155. #
  1156. # This option is used to determine where, if anywhere, the summary scan time is
  1157. # displayed. A value of '0' indicates that it should not be displayed anywhere.
  1158. # A value of '1' indicates that the time should only appear on the screen, and a
  1159. # value of '2' that it should only appear in the log file. A value of '3'
  1160. # indicates that the time taken should appear both on the screen and in the log
  1161. # file.
  1162. #
  1163. # The default value is '3'.
  1164. #
  1165. #SHOW_SUMMARY_TIME=3
  1166. #
  1167. # The two options below may be used to check if a file is missing or empty
  1168. # (that is, it has a size of zero). The EMPTY_LOGFILES option will also check
  1169. # if the file is missing, since that can be interpreted as a file of no size.
  1170. # However, the file will only be reported as missing if the MISSING_LOGFILES
  1171. # option hasn't already done this.
  1172. #
  1173. # Both options are space-separated lists of pathnames, and may be specified
  1174. # more than once.
  1175. #
  1176. # NOTE: Log files are usually 'rotated' by some mechanism. At that time it is
  1177. # perfectly possible for the file to be either missing or empty. As such these
  1178. # options may produce false-positive warnings when log files are rotated.
  1179. #
  1180. # For both options the default value is the null string.
  1181. #
  1182. #EMPTY_LOGFILES=""
  1183. #MISSING_LOGFILES=""