Arch Linux

ChrisG

Member

From: USA

Registered: 2015-11-27

Posts: 29

Website

RKHunter too many arguments message

Hello all,
This post is in regards to RKHunter version 1.4.2-1. As of this writing, RKHunter 1.4.2-1 is available in the community repositories. When Grep was updated in Arch to grep v2.21, RKHunter would produce these results when running an update...

[ Rootkit Hunter version 1.4.2 ]

Checking rkhunter data files...
  Checking file mirrors.dat           [ No update ]
  Checking file programs_bad.dat      [ Updated ]
  Checking file backdoorports.dat     [ No update ]
  Checking file suspscan.dat          [ No update ]
  Checking file i18n/cn               [ No update ]
  Checking file i18n/de               [ No update ]
  Checking file i18n/en               [ No update ]
/usr/bin/rkhunter: line 7439: [: too many arguments
  Checking file i18n/tr               [ No update ]
  Checking file i18n/tr.utf8          [ No update ]
/usr/bin/rkhunter: line 7439: [: too many arguments
  Checking file i18n/zh               [ No update ]
  Checking file i18n/zh.utf8          [ No update ]

The official release on Sourceforge is still 1.4.2 but if you look in to the Revision tree log, you can see where this has been patched.

http://rkhunter.cvs.sourceforge.net/vie … r?view=log

Scroll down to revision 1.528 and you will see that 1 line has been added and the summary text describing the change...

Fix Fedora 21 grep seeing the i18n files as 'binary'. This is the same fix
as was applied previously for BSD.

It says Fedora but it applies to linux as a whole. That fix is adding this line in the RKHunter file...

GREP_OPT="-a"

The line comes after...

LINUXOS=1

I have written a simple sed command to insert the line...

sudo sed -i ‘18483 i\\tGREP_OPT=”-a”’ /usr/bin/rkhunter

I have tested this on a clean arch install with rkhunter installed right after. Now when you run update, you get this...

[ Rootkit Hunter version 1.4.2 ]

Checking rkhunter data files...
  Checking file mirrors.dat           [ No update ]
  Checking file programs_bad.dat      [ Updated ]
  Checking file backdoorports.dat     [ No update ]
  Checking file suspscan.dat          [ No update ]
  Checking file i18n/cn               [ No update ]
  Checking file i18n/de               [ No update ]
  Checking file i18n/en               [ No update ]
  Checking file i18n/tr               [ No update ]
  Checking file i18n/tr.utf8          [ No update ]
  Checking file i18n/zh               [ No update ]
  Checking file i18n/zh.utf8          [ No update ]

Here is the order...

1. Install RKHunter
2. Run the above sed command.
3. Run rkhunter --update.
4. Run rkhunter --propupd.
5. Perform your first scan.

When RKHunter has been updated in the repos, this fix should no longer be needed. I hope this is helpful.

I want to thank MrWeatherbee's post...
https://bbs.archlinux.org/viewtopic.php?id=190436

Finding that post got me started.

Last edited by ChrisG (2015-12-09 20:45:01)

---

Signature Geek - This is where you learn.