So I just installed and ran rkhunter which shows me green OKs / Not founds for everything except for: /usr/bin/lwp-request, like so:

/usr/bin/lwp-request                                     [ Warning ]

In the log it says:

Warning: The command '/usr/bin/lwp-request' has been replaced by a 
   script: /usr/bin/lwp-request: Perl script text executable

I already ran rkhunter --propupd and sudo apt-get update && sudo apt-get upgrade which didn't help. I installed Debian 9.0 just a few days ago and am a newcomer to Linux.

Any suggestions on what to do?

Edit: Furthermore chkrootkit gives me this:

The following suspicious files and directories were found:

/usr/lib/mono/xbuild-frameworks/.NETPortable/v5.0/SupportedFrameworks/.NET Framework 4.6.xml 

I guess that's a separate question? Or is this no issue at all? I don't know how to check if these files/directories are ok and needed.

Edit: Note I once also got warnings for "Checking for passwd file changes" and "Checking for group file changes" even though I didn't change any such afaik. An earlier and later scan showed no warnings - these just showed once. Any ideas?

  • 1
    lwp-request is supposed to be a Perl script, so that's an odd warning.
    – derobert
    Commented Jun 27, 2017 at 17:36
  • @derobert Do you get the same error then? Also the warning is imo about it having gotten replaced (to another perl script I guess) - not about it being a perl script. I copied its contents here: pastebin.com/bSLivGvz
    – mYnDstrEAm
    Commented Jun 27, 2017 at 17:47
  • 1
    I get the same warning on my Debian testing box. Your pastebin matches my copy of lwp-request too (though with line-ending changes, which I presume came from pastebin). So I suspect false alarm.
    – derobert
    Commented Jun 27, 2017 at 17:54

2 Answers 2


rkhunter needs to know what package manager you are using.

Create or edit /etc/rkhunter.conf.local and add the following line:


If you are not on Debian or Ubuntu, then change DPKG for your actual package manager.

This way, rkhunter will know to expect those executables to be scripts, and not flag the false positive.

It will ensure that if the files are tampered with, then a new positive result will show.

  • Great; but why can't I set it to "APT-GET"? (relevant question) And what's it using by default for checking the hashes if that's not DPKG for Debian? (No value, or a value of 'NONE', indicates that no package manager is to be used.)
    – mYnDstrEAm
    Commented Mar 15, 2018 at 16:36
  • @mYnDstrEAm rkhunter doesn't recognise apt as a package manager. dpkg is also a valid package manager on all systems that have apt (unless removed). I think the default value is RPM
    – MacroMan
    Commented Mar 15, 2018 at 16:42
  • 2
    @MacroMan The default value stated in the man page is NONE Commented Jan 1, 2019 at 13:33
  • The comments in rkhunter.conf state: "# NONE is the default for Debian as well, as running --propupd takes about 4 times longer when it's set to DPKG". See: github.com/crunchsec/rkhunter/blob/master/files/rkhunter.conf. It seems there is no need to set PKGMGR option Commented Apr 15, 2019 at 11:54
  • 1
    Dpkg is the package-manager, while apt(-get) is the frontend handling copying of packages from remote hosts, and automatic dependency downloads, and more. Same as Yum is a frontend to rpm.
    – PoC
    Commented Apr 11, 2020 at 10:40

As mentioned on: https://metacpan.org/pod/lwp-request, the lwp-request is a script that allows making http requests to web servers. It is not malicious and so the error can be ignored.

To suppress the error you need to allow the /usr/bin/lwp-request command to be used as a script. This can be done by adding the line:


To /etc/rkhunter.conf or /etc/rkhunter.conf.local file. See the SCRIPTWHITELIST option in the rkhunter.conf configuration file

This solution was mentioned on the Linux Mint forums

  • 7
    And what if someone manages to replace lwp-request with a malicious script? Please be extra cautious using this suggestion. It leaves you vulnerable!
    – MacroMan
    Commented Aug 23, 2019 at 8:44
  • @MacroMan yeah but it's the only known way to get rkhunter to stop giving spurious warnings about these files ... So blame rkhunter.
    – spinkus
    Commented Nov 11, 2020 at 5:26
  • 1
    @spinkus No, it's not. Let rkhunter know your package manager as per my answer and the warning will go away. Whitelisting something you don't control is just opening a vulnerability.
    – MacroMan
    Commented Nov 12, 2020 at 9:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .