Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I ran rkhunter and received the following warnings in its output:

$ rkhunter --update
$ rkhunter -c


Performing file properties checks
    /sbin/chkconfig                                          [ Warning ]

In the /var/log/rkhunter.log, it shows this message:

Warning: The command '/sbin/chkconfig' has been replaced by a script: /sbin/chkconfig: Perl script, ASCII text executable

Though I am on a Debian system and am aware of update-rc.d, I occasionally use chkconfig to configure services.

What does this warning mean? How serious is this?

share|improve this question
up vote 3 down vote accepted

I would think that this warning is harmless (assuming you have not been hacked or you haven't installed any suspicious packages), it seems that rkhunter thinks that scripts in /sbin are suspicious behaviour.

In fact, checked on a clean Ubuntu install I have here and chkconfig is indeed a script.

share|improve this answer
You meant chkconfig is indeed a script as opposed to a binary, right? Just trying to understand here. What is the difference? – Nanda Oct 24 '12 at 14:08
Exactly; type file /sbin/chkconfig and see for yourself. The main difference is that a script is (generally) written in an interpreted language (bash, perl etc...) and a binary is the result of compiling a program (e.g. written in C); from an end-user (not a developer) point of view, there isn't much difference. – Renan Oct 24 '12 at 14:37
Since /sbin is supposed to have binaries in it, rkhunter threw a warning since it encountered a script rather than an executable. It makes sense. – Nanda Oct 24 '12 at 14:40

Assuming you're running Ubuntu, create (or edit) the file /etc/rkhunter.conf.local and add the following line.


This tells rkhunter to use the file hash info available via dpkg.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.