Update RKHunter & Fix False Positives

First, log in as root sudo su and edit the configuration file: sudo vim /etc/rkhunter.conf

Fix the Database Update

First, the rkhunter --updateNeeds to work, so change the existing file to the following entries to match what is listed below:

WEB_CMD=""
UPDATE_MIRRORS=1
MIRRORS_MODE=0

While still in the conf file, fix the lwp-request false-positive and uncomment the following line:

SCRIPTWHITELIST=/usr/bin/lwp-request

Run the Update

Save, exit, and run the update. After this, we run the propupd which updates the entire file properties database:

rkhunter — update && \
  rkhunter — propupd

Shared Memory Segments

These are a bit of a guess. I don’t know yet but all I’ve come up with searching is Nginx, Apache, or Mono — though it doesn’t seem to resolve the issue.

This step is not necessary.

ALLOWIPCPROC=/usr/sbin/nginx

Or for Apache:

# Debian/Ubuntu
ALLOWIPCPROC=/usr/sbin/apache2
# CentOS/RHEL
ALLOWIPCPROC=/usr/sbin/httpd

Run Rootkit Hunter

The updates work and you should have removed several false positives.

rkhunter -c