为什么 rkhunter 跳过空的和丢失的日志文件扫描？

Question

首先，根据手册页 --checkall不是有效命令。可能rkhunter将其解释为--check。

检查丢失和空的日志文件由文件系统测试。两者都是用户定义的检查；您必须告诉rkhunter它应该检查哪些日志文件。这是相关部分/etc/rkhunter.conf：

# The two options below may be used to check if a file is missing or empty
# (that is, it has a size of zero). The EMPTY_LOGFILES option will also check
# if the file is missing, since that can be interpreted as a file of no size.
# However, the file will only be reported as missing if the MISSING_LOGFILES
# option hasn't already done this.
#
# Both options are space-separated lists of pathnames, and may be specified
# more than once.
#
# NOTE: Log files are usually 'rotated' by some mechanism. At that time it is
# perfectly possible for the file to be either missing or empty. As such these
# options may produce false-positive warnings when log files are rotated.
#
# For both options the default value is the null string.
#
#EMPTY_LOGFILES=""
#MISSING_LOGFILES=""

我想它是不言自明的。

关于Test 'apps' disabled at users request信息消息，答案也在中/etc/rkhunter.conf。您应该在这里查看：

# These two options determine which tests are to be performed. The ENABLE_TESTS
# option can use the word 'ALL' to refer to all of the available tests. The
# DISABLE_TESTS option can use the word 'NONE' to mean that no tests are
# disabled. The list of disabled tests is applied to the list of enabled tests.
#
# Both options are space-separated lists of test names, and both options may
# be specified more than once. The currently available test names can be seen
# by using the command 'rkhunter --list tests'.
#
# The supplied configuration file has some tests already disabled, and these
# are tests that will be used only occasionally, can be considered 'advanced'
# or that are prone to produce more than the average number of false-positives.
#
# Please read the README file for more details about enabling and disabling
# tests, the test names, and how rkhunter behaves when these options are used.
#
# The default values are to enable all tests and to disable none. However, if
# either of the options below are specified, then they will override the
# program defaults.
#
# hidden_procs test requires the unhide and/or unhide.rb commands which are
# part of the unhide respectively unhide.rb packages in Debian.
#
# apps test is disabled by default as it triggers warnings about outdated
# applications (and warns about possible security risk: we better trust
# the Debian Security Team).
#
ENABLE_TESTS=ALL
DISABLE_TESTS=suspscan hidden_procs deleted_files packet_cap_apps apps

如果您确实想运行所有测试，可以从DISABLE_TESTS要运行的测试名称中删除或将其全部替换为。或者，您可以使用以下命令运行所有测试：NONErkhunter

sudo rkhunter --sk --enable all --disable none

Answer 1