[CentOS] semi-OT: rkhunter, fix "broken links"

Fri Aug 7 15:10:21 UTC 2015
m.roth at 5-cent.us <m.roth at 5-cent.us>

John Horne wrote:
> On Fri, 2015-08-07 at 09:45 -0400, m.roth at 5-cent.us wrote:
>> Hi, folks,
>>
>>    rkhunter is reporting a broken link on one of our servers. This is
>> quite reasonable, since it's on a drive whose controller card I have
>> declared dead the other day. I've been googling, searching in the
>> manpage, and I've done an rkhunter --propupd, but it still finds the
>> broken link. Anyone know how to remove the link from the rkhunter
>> d/b?
>>
> Take a look at the EXCLUDE_USER_FILEPROP_FILES_DIRS option in the
> config file. Set it to the link pathname, then run propupd again.

No joy. Tried it, still found a broken link.  *If* I read the information
in the configuration file correctly, then it *appears* to me that the
directory, etc, needs to exist to be excluded.

Still fighting it. I'm assuming that the rkhunter d/b is loaded, and never
has deletions or alterations....

        mark