I'm using ART's rkhunter package, but I just had to use the hashupd.sh script because apparently the prelinking database became out of step with the rkhunter local MD5 hash values. Could you maybe include this script in your RPM?

I found running this script was the solution in section 4.4 of the rkhunter FAQ.

Some clarification from one of the current maintainers on the rkhunter users mailinglist:

Got it, hashupd and a whole redesign of the nightly reporting events are in 1.2.9-3. Ive got it set now so that by default, it wont send you anything unless theres something to worry about. If you do want the nightly reports like the old version, you just modify the /etc/sysconfig/rkhunter file.

Thanks, great!

I already upgraded to 1.2.9-2 on two boxes yesterday and I noticed that upon upgrading to 1.2.9-3 /etc/sysconfig/rkhunter was overwritten so I had to set the MAILTO again.

OK -5 should be hitting the archive shortly. Ive corrected the config settings on /etc/sysconfig/rkhunter and /etc/rkhunter.conf, and added in a hashupd.sh event on an upgrade detection. I also changed the MAILTO variable to root, instead of root@localhost. That should make it so alerts will still be sent, even if you arent running a local MTA.

So now there's a MAILTO setting in /etc/sysconfig/rkhunter and a MAIL-ON-WARNING setting in /etc/rkhunter.conf? The first one is used for sending full reports and the other for sending an e-mail when there is a warning? Do you have to set both?

Yeah so what I did is modify the package so the only config you should have to deal with is /etc/sysconfig/rkhunter. By default its only going to email you if something has been detected. I see rkhunter as more of a forensics tool, if it tells you something is wrong, its the worst case scenario and you're looking at a reinstall. Assuming its not a false positive that is, the hash table updates are consistantly ugly and will get out of sync frequently resulting in misfires.

The daily everything is OK full report is still available, I just tied it to the DIAG_SCAN setting in /etc/sysconfig/rkhunter, change that to "yes" and you'll get that, plus the application scan (checks versions on openssh, apache, etc. High false positive rate, be advised).

Ok, great. Thanks.