root rkhunter Daily Run email

chanklish

• March 04, 2019 06:00

i installed RK hunter a while ago then removed it and removed all the chron job of it but i keep getting an email everyday with this subject rkhunter Daily Run (name of my server) and it only has a "=" in the mail body coming from root i suppose this is my cpanel provider what can i do ?

• 

  cPanelMichael

  • March 04, 2019 22:44

  Hello @chanklish, Can you check to see if any cron jobs are configured for the RKHunter script? The root cron jobs are stored in /var/spool/cron/root. You can edit the root cron jobs using the crontab -e command. Thank you.

  0
• 

  chanklish

  • March 05, 2019 06:20

  Hello @chanklish, Can you check to see if any cron jobs are configured for the RKHunter script? The root cron jobs are stored in /var/spool/cron/root. You can edit the root cron jobs using the crontab -e command. Thank you.

  
  all cron files are empty except for the root file with the below - nothing related to rkhunter 0 6 * * * /usr/local/cpanel/scripts/exim_tidydb > /dev/null 2>&1 30 5 * * * /usr/local/cpanel/scripts/optimize_eximstats > /dev/null 2>&1 @reboot /usr/local/cpanel/bin/onboot_handler 44 21 * * * /usr/local/cpanel/whostmgr/docroot/cgi/cpaddons_report.pl --notify 19 0 * * * (/usr/local/cpanel/scripts/fix-cpanel-perl; /usr/local/cpanel/scripts/upcp --cron) 0 1 * * * /usr/local/cpanel/scripts/cpbackup 0 2 * * * /usr/local/cpanel/bin/backup 35 * * * * /usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check 45 */4 * * * /usr/bin/test -x /usr/local/cpanel/scripts/update_mailman_cache && /usr/local/cpanel/scripts/update_mailman_cache 30 */4 * * * /usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache 25 */2 * * * /usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1 15 */2 * * * /usr/local/cpanel/bin/dbindex >/dev/null 2>&1 15 */6 * * * /usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1 */5 * * * * /usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1 0,15,30,45 * * * * /usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1 0 3 * * * /usr/local/cpanel/3rdparty/bin/clamscan --exclude-dir=virtfs -ir /home/ 5,20,35,50 * * * * /usr/local/cpanel/scripts/eximstats_spam_check 2>&1 0 */2 * * * /usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1 09,39 * * * * /usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1
  but then i found cron jobs related to rkhunter in /etc/cron.daily and delete them . will wait for verify

  0
• 

  chanklish

  • March 05, 2019 07:27

  i still received an email .

  0
• 

  cPanelMichael

  • March 05, 2019 16:39

  but then i found cron jobs related to rkhunter in /etc/cron.daily and delete them .

  
  Hello @chanklish, Check for additional cron jobs in the following directories as well: /etc/cron.d/ /etc/cron.hourly/ /etc/cron.monthly/ /etc/cron.weekly/ Thank you.

  0
• 

  RayJ

  • February 04, 2020 21:17

  Set the email here: /etc/sysconfig/rkhunter The cron is in /etc/cron.daily ( /etc/cron.daily/rkhunter )

  0
• 

  chanklish

  • February 05, 2020 06:54

  where can i find a step by step walkthrough on installing RKhunter ?

  0

Please sign in to leave a comment.